docs(working): handover for the documentation reconciliation

Two-part handover following the repo's existing convention: Part A for a fresh Claude session, Part B for the owner. Part A leads with the trap rather than the deliverables, because it is the thing most likely to cause damage: main advanced 13 commits mid-audit and had already fixed two of the audit's findings, so this branch would have reverted them without the merge. Includes the fetch-and-merge commands to re-check the baseline if main has moved again overnight. Also records, so a future session does not undo them: - The tense split — past-tense records are annotated, never rewritten. "Finishing the job" by rewriting the milestone docs or the 41 completed plans is the wrong instinct and destroys the audit trail. - One finding was WITHDRAWN during the audit (the asset table lists esbuild entry points, so imported-only sources are correctly absent). Adding them back would reintroduce a non-defect. - The known false-positive link-check hit inside a ```diff fence. - The submodule invariant: git diff main..HEAD -- user must stay empty. An earlier git reset -- user here silently reverted main's pin bump; that was caught, and the check is written down so it is not re-broken. - P5's booby trap: removing shortcode-gallery-plusplus may take shortcode-core with it and break stories. Part B is the two things only the owner can do: one command to open the PR (tea needs an interactive TTY), and the 7 recommendation decisions with why each needs a human. Notes that the PR body file lives in a Claude job dir and is reconstructable from the spec if it has been cleaned up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Merge main into feat/docs-reconcile; defer to main on two overlapping fixes
2026-07-25 01:10:38 +02:00 · 2026-07-25 00:21:47 +02:00 · 2026-07-25 00:18:36 +02:00 · 2026-07-24 23:54:43 +02:00 · 2026-07-24 23:53:24 +02:00 · 2026-07-24 23:49:36 +02:00
17 changed files with 1131 additions and 65 deletions
@@ -46,8 +46,8 @@ The site is Grav (flat-file PHP CMS, no database) in Docker, with content and th
 Trip and home render the same map and feed chrome through two shared partials, both included `with {…} only`. Parameter contracts: [`docs/reference/architecture.md`](docs/reference/architecture.md) → "Shared partial contracts". What must not break:
- **`partials/entry-map.html.twig` is the only path for a *display* map** — the engine is `MapUtils.initEntryMap(opts)` in `js/maplibre-utils.js` (a hand-authored file, imported by `js/src/map.js`). Do not add a third; an older three-variant setup was deliberately consolidated away.
+- **`partials/entry-map.html.twig` is the only path for a *display* map** — the engine is `MapUtils.initEntryMap(opts)` in `js/maplibre-utils.js` (a hand-authored file, imported by `js/src/map.js`). Do not add another display-map implementation; an older three-variant setup was deliberately consolidated away.
-  - **One sanctioned exception:** `js/src/location-map.js` is the `/post` pin *editor* — one draggable marker, no popups/GPX/bounds, `maplibre-gl` lazy-imported so a GPS-only submit never fetches it. It shares exactly one thing with the display path, the style URL in `js/src/map-style.js`. Do not fold them together.
+- **One sanctioned exception: `js/src/location-map.js`**, the `/post` form's pin *editor* (one draggable marker, no popups/GPX/bounds-fitting, `maplibre-gl` lazy-imported so a GPS-only submit never fetches it). It shares exactly one thing with the display path — `MAP_STYLE` from `js/src/map-style.js`, imported by both so the basemap cannot drift. Do not fold it into `initEntryMap`, and do not add a *third* path.
 - It must keep assigning **`window.tripMap` / `window.homeMap`** — the Playwright map specs assert those globals.
 - **Keep `trip-feed-col.html.twig` single-purpose.** Its sibling `partials/home-predeparture.html.twig` is the home-only "Coming soon" state — do **not** fold the pre-departure branch back into it.
@@ -48,6 +48,24 @@ A server's per-host configuration overlay. Once it exists, Grav's Admin writes *
 ### Remote-only plugin
 One of the project's three plugin-management categories, alongside GPM-managed (declared in the shared install list and restored by the standard install flow) and custom-in-repo (code tracked in the Content repo). A Remote-only plugin is installed explicitly on servers and restored by **no** standard flow — if its code goes missing it stays missing until someone reinstalls it deliberately, even while its configuration persists in the Env tree.
 ## Documentation
 ### Historical record
 A document that states what was decided or built at a past moment, not what is true now — plans, specs, milestone scopes, and session write-ups. Its going out of date is expected and is what makes it a record; it is corrected only by annotation, never by rewriting, because the value is the reasoning at the time.
 Distinguished from *current documentation*, which asserts how the system is today and is simply wrong when it drifts. A Historical record often reads in present tense, so the distinction is carried by an explicit marker rather than by tone.
 ### Superseded decision
 Something the project planned or built and then deliberately reversed, recorded so the reversal is discoverable from the document that still describes the original. Each one names what was planned, what replaced it, when, and why.
 The record exists because a reversal is otherwise invisible: the old document keeps asserting the old thing, and the reasoning that killed it lives only in whoever remembers. A Superseded decision is the standing answer to "may I re-create this?" — usually no, and often the prohibition is also a hard rule.
 ### Plan status
 The single recorded state of a plan, carried on the plan itself rather than in a separate tracker. **Deferred** and **Abandoned** are deliberately distinct: Deferred means still wanted but not now, Abandoned means decided against, kept so the decision is not re-litigated.
 A status that lags reality is worse than no status, because it is trusted — so it moves when the work lands, not later.
 ## Flagged ambiguities
 - "daily" / "entry" / "journal post" all refer to the same concept (a dated journal post). Canonical term: **Entry**. The section/folder is named "dailies" and the nav label is "Journal" — these name the *collection*, not a different entity.
 - A **Historical record** written in present tense is **not** a claim about the current system. Staleness there is correct; staleness in current documentation is a defect. When the two disagree, the code decides, and the gap is recorded as a **Superseded decision**.
@@ -54,9 +54,15 @@ $(foreach t,$(REMOTE_TARGETS),$(foreach e,$(ENVS),$(eval $(call make-env-target,
 GRAV_TEST_USER ?= testrunner
 GRAV_TEST_PASS ?= Testpass1234
 # The password is handed to the container through `docker exec -e` (the bare
 # form, which forwards the already-exported variable) rather than interpolated
 # into the `sh -c` string. Interpolating it meant any shell-special character in
 # GRAV_TEST_PASS was re-parsed by the container's shell — a `.env` password
 # containing one produced `sh: 2: <fragment>: not found` and no test account.
 # The recipe is now indifferent to the password's contents.
 test-account:
-	@docker exec $(GRAV_CONTAINER) sh -c 'test -f /var/www/html/user/accounts/$(GRAV_TEST_USER).yaml \
+	@docker exec -e GRAV_TEST_PASS $(GRAV_CONTAINER) sh -c 'test -f /var/www/html/user/accounts/$(GRAV_TEST_USER).yaml \
-		|| php bin/plugin login new-user -u $(GRAV_TEST_USER) -p "$(GRAV_TEST_PASS)" \
+		|| php bin/plugin login new-user -u $(GRAV_TEST_USER) -p "$$GRAV_TEST_PASS" \
 		   -e $(GRAV_TEST_USER)@example.test -N "Test Runner" -P b --admin-type both -s enabled -n'
 test-config:
@@ -65,6 +71,13 @@ test-config:
 test-post: test-account
 	@bash scripts/test-post.sh
 # Pinned to THIS checkout's port, not playwright.config.js's :8081 default. In a
 # worktree that default silently pointed the suite at the main checkout's server,
 # so entries were created in main's user/ while the specs asserted and cleaned up
 # in the worktree's — leaving ui-test entries behind in real trip content.
 # tests/global-setup.js now also hard-fails on that mismatch.
 GRAV_BASE_URL ?= http://localhost:$(GRAV_PORT)
 test-ui: test-account
 	@npx playwright test
@@ -98,8 +111,18 @@ build-assets:
 	  -w /app node:20-alpine \
 	  sh -c "npm install && npm run build"
 # In a worktree this degrades to start-grav. The travel-memories service declares
 # `env_file: .env`, and worktree-new does not create a .env, so a plain
 # `docker compose up -d` there dies with "env file ... not found" — leaving the
 # worktree with no server at all, which is how test runs ended up silently
 # targeting the main checkout.
 start:
-	docker compose up -d
+	@if [ -f .worktree-env ]; then \
 	  echo "→ worktree: starting the grav service only (travel-memories needs a .env, which worktrees have none)"; \
 	  docker compose up -d grav; \
 	else \
 	  docker compose up -d; \
 	fi
 # Grav service only — used by `make worktree-new` (a worktree rarely needs the
 # travel-memories service, and this keeps its footprint minimal).
@@ -177,6 +200,12 @@ worktree-rm: guard-name
 	-git -C "$(WT_DIR)" submodule deinit -f user
 	git worktree remove --force "$(WT_DIR)"
 	git worktree prune
 	# The deinit above is required (a populated user/ blocks `worktree remove`),
 	# but worktrees SHARE .git/config — so it also strips submodule.user.url for
 	# the MAIN checkout, leaving `git submodule status` there showing `-` (not
 	# initialised) even though user/ is intact. Re-register it; init is
 	# idempotent and touches config only, never the working tree.
 	git submodule init
 	@echo "Removed $(WT_DIR). If feat/$(NAME) is merged, drop it: git branch -d feat/$(NAME)"
 # ── Demo content ──────────────────────────────────────────────────────────────
@@ -185,6 +214,13 @@ demo-load:
 	# Load every fixture trip under docs/demo/trips/ into the pages tree.
 	# Source uses dailies/ + 04.stories/; dailies/ maps to 01.dailies/ on copy.
 	# All copies are `|| true` so a fixture absent from an older user/ is skipped.
 	#
 	# ⚠️ A fixture whose folder name matches a REAL trip's slug is copied straight
 	# over that live page — docs/demo/trips/italy-2025/ collides with the real
 	# italy-2025 trip on purpose (the fixture supplies its GPX + dailies). So any
 	# field the fixture's trip.md omits gets silently deleted from real content on
 	# every test run: it had been dropping the trip's tagline that way. Keep a
 	# colliding fixture's trip.md byte-identical to the live page.
 	docker exec $(GRAV_CONTAINER) bash -c 'for src in /var/www/html/user/docs/demo/trips/*/; do \
 		slug=$$(basename "$$src"); dst=/var/www/html/user/pages/01.trips/$$slug; \
 		mkdir -p "$$dst/01.dailies" "$$dst/04.stories"; \
@@ -34,7 +34,7 @@ ledger that lags is worse than no ledger, because it is trusted.
 | R10 | `shortcode-gallery-plusplus` as the entry photo gallery | `pm-analysis.md` | Galleries are **PhotoSwipe**, wired in `js/src/main.js` against `.pswp-gallery` markup emitted by `partials/entry-journal.html.twig`. No `[gallery]` shortcode is used anywhere in `templates/` or `pages/` | 2026-06-21 (`30c8937`, "replace custom lightbox with PhotoSwipe v5") | A lightbox the theme controls beat a plugin's markup. ⚠️ The plugin is **still listed in `plugins.txt`** with no consumer — see recommendations |
 | R11 | `travel-memories` as an in-repo service on :8082, built from `./services/travel-memories` | `plans/2026-06-21-travel-memories.md`; `specs/2026-06-21-travel-memories-design.md`; `working/2026-06-21-travel-memories-handover.md` | **Extracted to a separate project.** `services/` is gitignored and the source is absent from this repo | `a80b0a9` — "remove travel-memories service from repo (moved to separate project)" | It was an independent Flask app with its own lifecycle. ⚠️ `docker-compose.yml` **still declares the service**, so `make start` fails on a clean checkout — see recommendations |
 | R12 | Three map template variants (`feed-map.html.twig` partial with inline init, plus full-page `map.html.twig`) | pre-2026-06-27 templates | **One display map path** — `MapUtils.initEntryMap()` in `js/maplibre-utils.js`, invoked through `partials/entry-map.html.twig` | Consolidated 2026-06-27, variants deleted 2026-07-04 | `plans/2026-06-27-map-init-consolidation.md`. Three implementations drifted apart |
-| R13 | A single map code path, no exceptions | `CLAUDE.md` (pre-2026-07-25 wording) | One **display** path (R12) **plus one sanctioned editor** — `js/src/location-map.js` for the `/post` pin picker: one draggable marker, no popups/GPX/bounds, `maplibre-gl` lazy-imported. Shares only `MAP_STYLE` with the display path | 2026-07-24 (`dd19995`) | `plans/2026-07-23-post-form-location-override.md`. An editor map has none of a display map's concerns; folding them together would have compromised both |
+| R13 | A single map code path, no exceptions | `CLAUDE.md` (pre-2026-07-24 wording) | One **display** path (R12) **plus one sanctioned editor** — `js/src/location-map.js` for the `/post` pin picker: one draggable marker, no popups/GPX/bounds, `maplibre-gl` lazy-imported. Shares only `MAP_STYLE` with the display path | 2026-07-24 — `user/` `dd19995`, outer `4450bd6`; the rule was carved out in `829325c` | `plans/2026-07-23-post-form-location-override.md`. An editor map has none of a display map's concerns; folding them together would have compromised both |
 | R14 | `post-form.md` carries a static `pageconfig.parent` naming the write target | pre-2026-07 form config | **No `parent` in `post-form.md`.** `cache-on-save` derives it from `site.active_trip` at submit time | 2026-07 | The two settings silently desynced. **Never re-add it** — this is a hard rule in [`CLAUDE.md`](../../CLAUDE.md) |
 ---
@@ -0,0 +1,253 @@
 ---
 title: Reconciling drifted docs — tier by tense, and record reversals in a ledger
 date: 2026-07-25
 category: conventions
 module: documentation
 problem_type: convention
 component: documentation
 severity: high
 applies_when:
  - Auditing documentation against the code after a period of undocumented change
  - Deciding whether a stale document should be corrected, annotated, or deleted
  - A plan or milestone describes a feature that was later dropped or replaced
  - Writing or reviewing an index that describes what another document is for
  - Asked whether the docs would pass a review, or to make them pass one
  - A decision is being reversed and the old rationale needs to survive the reversal
 tags: [documentation-conventions, staleness, tiering, drift, supersession, decision-log, audit, verification, indexes]
 ---
 # Reconciling drifted docs — tier by tense, and record reversals in a ledger
 ## Context
 Five weeks after the last documentation pass, this repo's docs described a site that partly no longer
 existed. `/map`, `/stats`, `/tracker`, Leaflet, a light theme, and `hero_image` on entries had all been
 deliberately removed — but several documents still presented them in confident present tense, and
 nothing marked those documents as historical.
 The trigger question was *"straighten this out so a repeat review returns ok."* The answer depended on
 a distinction the tree did not encode.
 [`claude-md-content-tiering.md`](claude-md-content-tiering.md) established that **descriptions drift
 and rules do not**, and tiered content by *type* (rules stay in `CLAUDE.md`, descriptions move to
 `docs/`). This pass confirmed that thesis again — every one of 20 verified defects was a description
 of code, config, or a command; not one was a rule that had gone wrong on its own. But content-type
 tiering alone did not answer what to *do* with 41 completed plans and 4 milestone specs, because those
 are neither rules nor current descriptions.
 The missing axis was **tense**.
 ## Guidance
 ### 1. Tier by tense, then treat the halves oppositely
 | Kind | Files here | Claims | Staleness is | Treatment |
 |---|---|---|---|---|
 | **Present-tense** | `CLAUDE.md`, `docs/reference/`, `docs/guides/`, `README.md`, `CONCEPTS.md` | "this is how it *is*" | a **defect** | correct against the code |
 | **Past-tense** | `docs/working/plans/`, `specs/`, `milestones/`, `summary.md`, `pm-analysis.md` | "this is what we decided *then*" | **correct and expected** | annotate only, never rewrite |
 A completed plan *should* be stale — that is what makes it a record. Rewriting 41 plans to match
 today's code would destroy the audit trail of *why* each thing changed, and the work is unbounded.
 The defect was never their staleness; it was that nothing told a reader they were history.
 `docs/solutions/` straddles the split deliberately: past-tense incident, present-tense guidance. That
 is why its `applies_when` frontmatter matters more than its narrative — the frontmatter is the part
 that must stay true.
 ### 2. Ledger plus inline notes — neither alone is enough
 Two mechanisms, because each covers the other's failure:
 - **A supersession ledger** (`docs/reference/superseded-decisions.md`) — one table: what was planned,
  where it was planned, what is true now, when it changed, why. This is the only thing that answers
  *"what did I change my mind about?"* in one place, which is the question a review actually asks.
  Alone, it has an indirection problem: a pointer you might not follow.
 - **Inline `> **Superseded …**` notes** at each stale claim, so the claim cannot be read
  un-corrected. Alone, it has a completeness problem: no changelog view, and coverage is only as good
  as the annotation pass was.
 **Prefer the annotation patterns the repo already uses.** Here, `architecture.md` already carried
 `> History:` notes and `trip-switching.md` already carried `> **Changed 2026-07:**`. Inventing a third
 convention would have been worse than adopting either.
 **Add the ledger row in the same commit as the reversal.** A ledger that lags is worse than no ledger,
 because it is trusted — the same failure mode as a lagging plan `Status:` line.
 ### 3. Also record what was *not* reversed
 A ledger of only reversals makes every old document look suspect. This one ends with a short
 "decisions that were *not* reversed" section — the `pm-analysis.md` SKIP list still stands, the
 weather integration shipped exactly as specified, the stats computation survived and only *moved*.
 Without it, a future reader re-litigates settled decisions because the surrounding docs looked old.
 ### 4. Separate "the docs are wrong" from "the code is wrong"
 An audit against code finds both. Mixing them makes the diff unreviewable and stalls the documentation
 fix behind a behaviour decision. Route code-side findings to a separate recommendations document and
 **explicitly do not act on them**. Here that kept a 300-line docs diff clean while still capturing that
 `make start` is broken on any clean checkout.
 Documenting a trap is not the same as fixing it — and is the right move when the fix is someone else's
 call. Per the tiering doc, a gotcha has no natural trigger that opens a file, so a live trap belongs in
 `CLAUDE.md` even while its fix stays unscheduled.
 ### 5. Verify against the artifact that decides behaviour, not the prose about it
 Every finding must come from the thing that actually determines behaviour:
 | To check | Read |
 |---|---|
 | What a command does | the `Makefile` — including macro-generated targets, which a grep for literal target names will miss |
 | What a build produces | the build script (`package.json`), not a prose asset table |
 | Whether a file is a source or an output | which file *imports* it, and how it reaches the page |
 | Whether a feature exists | the absence of its mechanism, not the absence of a mention |
 | Whether a plan shipped | the branch history, not the plan's own `Status:` line |
 This is also where an audit catches *itself*. One draft finding here claimed the asset table was
 missing four source files; reading `package.json` showed the table lists esbuild **entry points**, so
 imported-only sources were correctly absent. The finding was withdrawn. **An audit that never
 withdraws a finding has not been checking itself.**
 ### 6. Re-check the baseline before publishing, not only before starting
 A long audit **races the work it is auditing**. This one had its baseline move twice, and each time the
 convenient state was the wrong one:
 - **The submodule pin lagged.** A fresh worktree checks out the commit the outer repo pins, not the
  submodule's real HEAD. Auditing the pin would have reported a shipped feature as unbuilt. Move to the
  real HEAD first, and keep the gitlink out of the commit (see
  [`dual-repo-submodule-workflow.md`](../architecture-patterns/dual-repo-submodule-workflow.md) —
  `M user` is normal and must not be "fixed").
 - **The base branch advanced 13 commits mid-audit**, independently fixing two findings. Merging the
  base branch in before opening the PR is what surfaced that. Without it, the branch would have
  **reverted** work that was already correct — the worst possible outcome for a cleanup pass, because it
  arrives disguised as an improvement.
 Two habits fall out of this. **Merge the base branch in before publishing, and read the conflicts as
 findings rather than chores** — each conflict is the codebase telling you someone else already reasoned
 about this line. And **when the incoming version is better, take it wholesale**: here the base branch's
 map-doctrine wording and plan status were both more informed than the replacements drafted during the
 audit, so they were kept in full and the audit's own notes were corrected to match. An audit has no
 special authority over the work it audits.
 ## Why This Matters
 **An index describing another document's role makes a factual claim that can rot — and it is worse
 than the stale document itself.** The single most misleading line in this tree was
 `docs/working/README.md` advertising `summary.md` as *"Project summary / current state"*, while
 `summary.md` described Leaflet, `/tracker`, `/map` and `/stats`. A stale document is survivable — a
 reader may notice the date, the tone, the odd claim. An index that vouches for it as authoritative
 **defeats that judgement before it engages.** When writing an index, treat every "what this file is
 for" phrase as an assertion with an expiry date.
 **Wrong beats absent, again — now for commands.** The tiering doc found this for paths: an absent fact
 makes an agent go look; a wrong one makes it act confidently in the wrong place. The same held for
 `README.md`'s server runbook, where every `remote-*` command was documented without the `-test`/`-prod`
 suffix `guard-env` requires. Every documented command failed on the first line. `deploy-cycle.md` had
 the rule right the whole time — the defect was a **second copy** of the knowledge drifting from the
 first. Fewer copies would have prevented it outright.
 **Promoting a doc to "the authoritative list of X" creates a completeness obligation it did not have
 as prose.** `CLAUDE.md` pointed at `README.md` for "the full `make` command list"; README then held 7
 of ~20 `remote-*` targets. The pointer was added by a well-intentioned earlier tiering pass. Routing
 content out of an always-loaded file is right, but **the destination inherits a duty to be complete**,
 and nothing enforces that.
 **Deliberate removals leak.** `travel-memories` was extracted to its own project, its source deleted
 and `services/` gitignored — but `docker-compose.yml` still declared the service, and `CLAUDE.md` still
 claimed it ran on :8082. `make start` has therefore been broken on every clean checkout since, hidden
 only because a pre-removal Docker image stayed cached locally. **A removal is not finished when the
 code is gone; it is finished when every consumer and every description of it is gone too.** The cached
 image is the general lesson: local state can mask a breakage indefinitely, so "it works here" is not
 evidence.
 ## When to Apply
 - After any stretch of change that outpaced its documentation, or when asked whether the docs would
  survive a review
 - Before rewriting a stale plan, spec, or milestone — annotate it instead; the record is the value
 - When reversing a decision: add the ledger row and the inline note in the reversal's own commit
 - When writing an index, a folder README, or any "read X for Y" pointer — that pointer is a claim
 - When removing a service, route, feature, or dependency: sweep for consumers *and* for prose that
  describes it, including compose files, always-loaded instruction files, and demo fixtures
 - When promoting any document to authoritative for a list — decide who keeps it complete
 - Before auditing a repo with submodules: confirm you are on the state that actually runs
 ## Examples
 ### Tense-marking a historical spec, without rewriting it
 `milestones/milestone-2.md` still opens with its original goal — that is the record. The banner sits
 directly beneath it, so the stale claim cannot be read alone:
 ```markdown
 **Goal:** A `/map` page shows all entries as markers on an interactive Leaflet.js map, …
 > **Superseded — written 2026-06-21. Neither the `/map` page nor Leaflet exists.**
 >
 > - **No `/map` route.** The map renders inline on the trip page via the single shared partial
 >   `templates/partials/entry-map.html.twig` (R1, retired 2026-07-04).
 > - **Leaflet + OpenStreetMap tiles → MapLibre GL JS** (R4, 2026-06-20).
 >
 > The *substance* of this spec survived — markers per entry, chronological route line, popups,
 > bounds fitting — it all lives in `MapUtils.initEntryMap()`. Only the page and the library changed.
 ```
 Separating "the idea won" from "this implementation lost" is what stops a future reader concluding the
 whole spec was a dead end.
 ### An index that vouched for a stale document
 ```diff
 -| `summary.md` | Project summary / current state |
 +| `summary.md` | **Historical** wrap-up of the original four-milestone branch (2026-06-21).
 +  *Not* the current state — for that read [`../reference/architecture.md`](../reference/architecture.md) |
 ```
 ### A source relationship that never existed
 `CLAUDE.md` asserted a build dependency between two unrelated things. `css/` is hand-authored and
 served *directly*; `css-compiled/` is esbuild output from the CSS imports inside `js/src/*.js`:
 ```diff
 -- `css-compiled/` and `fonts/` are generated (sources: `css/style.css`, `css/tokens.css`)
 +- `css-compiled/` and `fonts/` are **esbuild output from the imports inside `js/src/`** — *not*
 +  from `css/`. Everything in `css/` is hand-authored and served directly (`assets.addCss` in
 +  `partials/base.html.twig`), never compiled.
 ```
 The failure this invited: an agent wanting to change a font edits `css-compiled/main.css` — a
 generated bundle — because the rule named `css/style.css` as its source and that file does not contain
 it. The next `make build-assets` silently reverts the edit.
 ### Proving a breakage instead of inferring it
 Reasoning that a missing directory *would* break a build is not evidence. Running it is:
 ```console
 $ docker compose build travel-memories
 unable to prepare context: path ".../services/travel-memories" not found
 ```
 The follow-up mattered more than the failure: a cached `travel-blog-intotheeast-travel-memories:latest`
 image explained why `make start` still worked on the main checkout but failed in every new worktree.
 Without that check the finding would have been reported as "broken everywhere" and been wrong.
 ## Related
 - [`claude-md-content-tiering.md`](claude-md-content-tiering.md) — the content-type tiering axis and
  the "descriptions drift, rules don't" thesis this learning extends with a tense axis. **Consolidation
  candidate:** the two overlap on root cause and on the files they touch; if a third documentation
  learning appears, consider merging all three into one documentation-maintenance doc.
 - [`../architecture-patterns/retiring-a-consolidated-grav-sub-page.md`](../architecture-patterns/retiring-a-consolidated-grav-sub-page.md)
  — the mechanics of the retirement that produced ledger rows R1, R2 and R5. That doc covers removing
  the *page*; this one covers removing the *claims about* the page.
 - [`../architecture-patterns/dual-repo-submodule-workflow.md`](../architecture-patterns/dual-repo-submodule-workflow.md)
  — why a fresh worktree's `user/` sits at the pin rather than at HEAD, which is the audit-baseline trap
  in §6.
 - [`../integration-issues/stale-grav-version-blocks-api-plugin-install.md`](../integration-issues/stale-grav-version-blocks-api-plugin-install.md)
  — the same rot in the deploy-config domain: a version number that went stale and broke an install.
 - `docs/working/specs/2026-07-25-docs-reconciliation-design.md` — the design and the verification
  table for this pass.
 - `docs/working/2026-07-25-doc-drift-recommendations.md` — the code-side findings deliberately not
  acted on, including the compose breakage and a proposed repeatable `make docs-check`.
@@ -0,0 +1,208 @@
 # Documentation Reconciliation — Handover
 **Date:** 2026-07-25
 **Branch:** `feat/docs-reconcile` (worktree `.worktrees/docs-reconcile`, dev server :8091)
 **State:** Work **complete and pushed**. Remaining: **open the PR** (needs one interactive command) and **decide on 7 logged recommendations**. No code was changed; no `user/` commits were made.
 Two audiences:
 - **Part A — Claude → future Claude:** exact state, the one trap that nearly caused a regression, and what must not be "tidied up".
 - **Part B — Mischa:** the two things only you can do.
 ---
 ## Part A — Handover (Claude → future Claude)
 ### What this branch delivers
 A whole-repo reconciliation of the documentation against the code, after five weeks in which the app
 changed and the docs did not. **The code was treated as the source of truth throughout.**
 Three deliverables:
 1. **`docs/reference/superseded-decisions.md`** (new) — the supersession ledger. 14 reversals, each with
   what was planned, where, what is true now, when it changed, and why. Plus a "decisions that were
   *not* reversed" section so old planning docs don't all read as suspect.
 2. **Inline `> **Superseded …**` notes** at each stale claim, in the 4 milestone docs, `summary.md`,
   `pm-analysis.md`, and `design-system-light.md`. Reuses the repo's existing `> History:` /
   `> **Changed 2026-07:**` patterns — do not invent a third convention.
 3. **Corrections to the nine present-tense docs** (`CLAUDE.md`, `README.md`, `CONCEPTS.md`,
   `docs/README.md`, `docs/working/README.md`, `reference/architecture.md`,
   `reference/design-system.md`, `reference/design-system-light.md`, `guides/posting.md`).
 Plus the compounded learning (`docs/solutions/conventions/reconciling-drifted-docs-tense-tiering-and-a-supersession-ledger.md`),
 the design/verification record (`docs/working/specs/2026-07-25-docs-reconciliation-design.md`), and the
 unacted findings (`docs/working/2026-07-25-doc-drift-recommendations.md`).
 ### The governing idea — do not undo this
 Scope was split by **tense**, because the halves need opposite treatment:
 | Kind | Staleness is | Treatment |
 |---|---|---|
 | Present-tense: `CLAUDE.md`, `reference/`, `guides/`, `README.md`, `CONCEPTS.md` | a **defect** | corrected against the code |
 | Past-tense: `plans/`, `specs/`, `milestones/`, `summary.md`, `pm-analysis.md` | **correct and expected** | annotated only, **never rewritten** |
 **A completed plan is supposed to be stale — that is what makes it a record.** If a future session is
 tempted to "finish the job" by rewriting the milestone docs or the 41 completed plans to match today's
 code, that is the wrong instinct and destroys the audit trail. The banners are the fix.
 ### Commits (all on `feat/docs-reconcile`, all pushed)
 `origin/feat/docs-reconcile` == local `HEAD` == `7c9c140`.
 - `8202d2a` — the reconciliation: ledger + inline notes + the nine present-tense corrections
 - `d946eaa` — compounded learning into `docs/solutions/conventions/` + new `CONCEPTS.md` Documentation cluster
 - `7c9c140` — **merge of `main`** (see the trap below)
 Net diff vs `main` is 19 files, +897/−60, **no deletions**, and the submodule gitlink is byte-identical
 to `main`.
 ### ⚠️ The trap — `main` moved 13 commits mid-audit
 This is the most important thing on this page.
 While the audit ran, the location-override work was merged into the outer repo, advancing `main` by 13
 commits. **It independently fixed two of the audit's own findings:**
 - `829325c` — carved out the single-map-path exception for `js/src/location-map.js` in `CLAUDE.md`
 - `a517331` — set `2026-07-23-post-form-location-override.md` to `✅ Complete`
 Had this branch been merged without first merging `main` in, it would have **reverted both**. Both
 conflicts were resolved **in `main`'s favour** (its wording was better informed in each case), and the
 audit's own notes were then corrected to stop claiming credit for fixes it did not make.
 **If you pick this up on 2026-07-26 or later, `main` may have moved again. Do this first:**
 ```bash
 cd .worktrees/docs-reconcile
 git fetch origin
 git log --oneline HEAD..origin/main        # anything here? then merge before touching the PR
 git merge origin/main                      # read each conflict as a finding, not a chore
 ```
 Two rules that came out of this, now recorded in the learning doc §6:
 - **Re-check the baseline before publishing, not only before starting.** A long audit races the work it audits.
 - **When the incoming version is better, take it wholesale.** An audit has no special authority over the work it audits.
 ### Submodule situation
 - `user/` in this worktree is on branch `feat/docs-reconcile` at **`dd19995`** — I moved it off the
  outer repo's older pin (`02fa4e9`) so the audit ran against the state that actually runs. Auditing
  the pin would have reported a shipped feature as unbuilt.
 - **No commits were made inside `user/`.** `git -C user status` is clean. Nothing to push there.
 - The merge commit **preserves `main`'s pin bump to `dd19995`**. The no-gitlink-commit rule in
  `CLAUDE.md` is about not bumping the pin as a side effect of routine work — not about discarding a
  bump `main` already made. An earlier `git reset -- user` here had silently reverted it to the old pin;
  that was caught and fixed. **Verify before any future commit on this branch:**
  `git diff main..HEAD -- user` must be empty.
 ### What was verified, and how
 Nothing was inferred from prose. Full table in the spec doc; the load-bearing ones:
 | Claim | Verified against |
 |---|---|
 | Nav labels | `partials/base.html.twig:27-31` |
 | Asset sources → outputs | the theme's `package.json` build script |
 | `css-compiled/` provenance | CSS imports in `js/src/*.js`; `assets.addCss` in `base.html.twig:7-8` |
 | No light mode | absence of `prefers-color-scheme` / `data-theme` **and** of light hex values in `css/` |
 | Photo rules (1–6, required) | `user/pages/02.post/post-form.md:35-46` |
 | `entry-actions` routes | `entry-actions.php:63-73` |
 | Env-suffix rule | `Makefile` `guard-env:41-43` + the `make-env-target` macro at `:45-46` |
 | `travel-memories` removal | `git log -- services/` → `a80b0a9`, then a real `docker compose build` failure |
 **One finding was withdrawn** after reading `package.json`: the asset table lists esbuild *entry
 points*, so imported-only sources (`api-utils.js`, `location-map.js`, `map-style.js`, `post-form.css`)
 are correctly absent from it. If a future pass "fixes" that table by adding them, it is reintroducing a
 non-defect.
 Checks run before pushing: no conflict markers anywhere; `ce-compound`'s frontmatter validator exits 0;
 all relative links resolve. **One link check hit is a known false positive** —
 `../reference/architecture.md` inside a ```diff fence in the learning doc, quoting
 `docs/working/README.md`'s literal content, where that path is correct.
 ### Not done, deliberately
 - **The PR is not open.** `tea` requires an interactive TTY for the SSH passphrase. Command in Part B.
 - **None of the 7 recommendations were acted on**, per instruction. They are decisions, not chores —
  several are behaviour changes that would have made this diff unreviewable as documentation.
 - **No `user/` changes**, including the `italy-2025` demo fixtures (recommendation P6).
 ### Do not, without being asked
 - Rewrite any past-tense doc to match current code — annotate instead.
 - Act on `docs/working/2026-07-25-doc-drift-recommendations.md`. **P5 in particular is booby-trapped:**
  removing `shortcode-gallery-plusplus` may take `shortcode-core` with it (it is a GPM dependency and is
  *not* in `plugins.txt`), which would break stories. Add `shortcode-core` explicitly first, in its own
  step, then remove and verify a story page renders.
 - Bump the submodule pin beyond preserving `main`'s.
 - `content-push` — nothing here touches content.
 ### Environment
 Worktree dev server on **http://localhost:8091** (`itte_docs-reconcile_grav`, from `.worktree-env`).
 Nothing in this branch needs a running server — it is documentation only — so tearing it down is safe:
 ```bash
 make worktree-rm NAME=docs-reconcile     # compose down → submodule deinit → worktree remove → prune
 ```
 The branch is pushed, so removing the worktree loses nothing. Note `main`'s `cfe070e` fixed
 `worktree-rm` so it no longer unregisters `user/` for the main checkout — that fix is in this branch via
 the merge.
 ---
 ## Part B — For Mischa
 ### 1. Open the PR (one command)
 ```bash
 cd /home/mischa/Nextcloud/Projects/travel-blog-intotheeast/.worktrees/docs-reconcile
 tea pr create --login git.gorinskat.nl --repo m038/intotheeast-com \
  --head feat/docs-reconcile --base main \
  --title "docs: reconcile documentation against the code; add a supersession ledger" \
  --description "$(cat /home/mischa/.claude-work/jobs/18e4d444/tmp/pr-body.md)"
 ```
 Or in the browser: https://git.gorinskat.nl/m038/intotheeast-com/pulls/new/feat/docs-reconcile
 ⚠️ The body file lives in a Claude job directory and disappears when that job is deleted. If it is
 already gone, the PR description is reconstructable from
 `docs/working/specs/2026-07-25-docs-reconciliation-design.md` plus the recommendations doc.
 ### 2. Decide on the recommendations
 `docs/working/2026-07-25-doc-drift-recommendations.md`, ordered. The first is a live bug:
 | | What | Why it needs you |
 |---|---|---|
 | **P1** | `make start` / `make setup` fail on any clean checkout — `docker-compose.yml` still builds `travel-memories`, whose source you removed in `a80b0a9` | Three options (delete the service / put it behind a compose profile / re-point `build`). It is your call whether that project ever runs alongside Grav again. **It works on your machine only because a pre-removal Docker image is cached** — it breaks in every new worktree and after any `docker image prune` |
 | **P2** | A repeatable `make docs-check` | The half you deferred. Every defect this pass found was mechanically checkable, so this is what stops the drift recurring. Sequence it *after* P1, or the first thing it reports is P1 |
 | **P3** | Plan status can silently lag a merge | Three options, cheapest is naming the plan path in the feature commit |
 | **P4** | `README.md` was designated authoritative for a list it did not hold | Structural: either generate the command tables from the `Makefile`, or soften the `CLAUDE.md` pointer |
 | **P5** | `shortcode-gallery-plusplus` has no consumer | ⚠️ See the booby-trap warning in Part A before touching it |
 | **P6** | `italy-2025` demo fixtures still ship `map.md` / `stats.md` for retired views | A `user/` submodule change, so it was out of scope here |
 | **P7** | Structural notes — e.g. whether `design-system-light.md` should move out of `reference/`, since it documents a theme that does not exist | Judgement calls, both defensible |
 ### 3. Worth knowing
 The three findings most likely to have bitten you in practice:
 - **`posting.md` would have failed if followed** — it said photos were optional; they are required, 1–6.
 - **Every `make remote-*` command in `README.md` was unrunnable** — all documented without the
  `-test`/`-prod` suffix `guard-env` requires. `deploy-cycle.md` had it right the whole time; the defect
  was a second copy of the knowledge drifting from the first.
 - **`docs/working/README.md` advertised `summary.md` as "current state"** while `summary.md` describes
  Leaflet, `/tracker`, `/map` and `/stats`. An index that vouches for a stale doc is worse than the
  stale doc, because it defeats your judgement before it engages.
 ---
 ## Related
 - `docs/working/specs/2026-07-25-docs-reconciliation-design.md` — design, scope rationale, and the full verification table
 - `docs/reference/superseded-decisions.md` — the ledger itself
 - `docs/working/2026-07-25-doc-drift-recommendations.md` — the 7 unacted findings
 - `docs/solutions/conventions/reconciling-drifted-docs-tense-tiering-and-a-supersession-ledger.md` — the compounded learning
 - `docs/solutions/conventions/claude-md-content-tiering.md` — the prior learning this extends; flagged as a consolidation candidate if a third documentation learning appears
@@ -11,7 +11,22 @@ execution: code
 # Post Form Location Override - Plan
-**Status:** ✅ Complete (2026-07-24) — merged to `user/` `main` as `dd19995` ("Merge feat/post-location-override into main"). Delivered `js/src/location-map.js` (the lazy-imported single-draggable-marker pin editor) and `js/src/map-style.js` (`MAP_STYLE`, now the single source of the basemap URL for both map paths), plus the "More location details" disclosure with city/country search-by-lookup in `js/src/post-form.js`. The status line lagged the merge and was corrected during the 2026-07-25 documentation reconciliation; the second map engine is now recorded as the one sanctioned exception to the single-map-path rule in `CLAUDE.md` and in [`../../reference/superseded-decisions.md`](../../reference/superseded-decisions.md) → R13.
+**Status:** ✅ Complete (2026-07-24) — U1–U6 shipped, then hardened by a multi-agent code review the same day. The review found the design's stated server-side safety net (`cleanCoordinate()`) had never been committed, so it landed here; replaced a prefix-parsing coordinate check that accepted `48abc` / `48,85` / `35.0116S` (hemisphere silently flipped); closed three paths that bypassed the submit gate (draft restore, edit-mode prefill, map-load failure) because the gate read a CSS class no code set at init; added pin removal on blanked fields; made the geocode failure visible; and rewrote the U5 guard spec, which asserted only instantly-passing conditions and so could not fail. R8 and R13 above are revised accordingly.
 **Verified by a green run (2026-07-24).** The suite now executes end-to-end: `test-config` 22/22, `test-post` 6/6 (the `scripts/test-post.sh` shell suite — *not* the Playwright specs under `tests/ui/post/`, which is a separate set), and `location-override.spec.js` **20/20** — so the verifications below are no longer by inspection alone. Reaching that took fixing `make test-account` (the password was interpolated into an `sh -c` string, so a shell metacharacter in it killed every UI run), pinning `test-ui` to this checkout's own port, and repairing test cleanup, which had never been able to delete the root-owned entries Grav's Apache creates. See the commit `fix(test): close the test-entry leak into real trip content`.
 Also landed after the review: maplibre's stylesheet is now lazy-`<link>`ed at panel-open instead of statically bundled, cutting `post-form.css` from 92,244 to 26,784 raw bytes (14,528 → 5,631 gzip) on every `/post` load, with a new spec asserting both halves of that boundary.
 **Merged to `main` 2026-07-24** — `user/` at `dd19995`, outer at `4450bd6`, pin bumped. On merged `main`: `test-config` **22/22** and `tests/ui/post/` + `tests/ui/map` **69 passed / 1 failed** (DEL4 only, a pre-existing regression unrelated to this feature — see below). `user/` is still **unpushed by choice**; push `user/` first, then the outer repo.
 **Notes carried forward:**
 - The `user/` submodule commits remain **unpushed by choice** (git-sync would deploy to prod). Merged to `main` locally on 2026-07-24 and the pin bumped; pushing `user/` — then the outer repo, in that order — is the remaining step and is deliberately left to the user to time.
 - **DEL4 is a real, pre-existing regression and the one thing still red on `main`** (`tests/ui/post/delete-flow.spec.js:44`, reproducible in isolation). Deleting an entry works: the card leaves the DOM and the folder leaves disk (both asserted and both pass). But a fresh load of the trip page makes the server re-emit the card — an image-less ghost of a page whose content is gone. That is precisely the bug the spec's own header says was already fixed once, so the invalidation has regressed. `cache-on-save` clears the page-tree cache on form *submit*; the delete path evidently does not do the equivalent. Practical impact: delete a bad post from the road, reload, and it is back. Worth its own branch.
 - ~~This worktree's `user/` branch has diverged from `user/`'s `main`~~ **Done** — `user/main` merged in (`7903432`). It was ahead on both content and theme fixes; `denmark-2026 published: true` came with it, so the local testing flip is gone. The one conflict was `js/post/post-form.js`, a generated bundle, resolved by rebuilding rather than hand-merging minified output.
 - ~~The `~/Projects` clone's `user/` carries two commits this clone cannot see~~ **Done** — merged in (`8a5cc52`). There is no second clone: `~/Projects` is a symlink to `~/Nextcloud/Projects`. What differs is the **submodule git dir** — a worktree gets `.git/worktrees/<name>/modules/user`, not the checkout's `.git/modules/user` — so `user/main` read `4721af6` here while the checkout's read `285ae37`, and the leg-connection map fix and U+200E strip were unreachable until a local `git fetch` between the two paths. Worth remembering: submodule commits made from the main checkout do not appear in a worktree until fetched, and a local fetch carries them without a push, so git-sync never fires.
 - **Retracted: the "`owner_username` cluster" diagnosis was wrong.** The worktree showed 6 failures (AN2, DEL1–4, ES1) and they were attributed to `site.yaml` pinning `owner_username: mischa` while the suite authenticates as `testrunner`. On merged `main` only DEL4 fails, with byte-identical `site.yaml` and content — so auth was not the cause. The difference is environmental: the isolated worktree's `user/plugins/` was incomplete (missing `admin`, `markdown-notices`, `migrate-grav`, since `plugins/` is git-ignored and populated per-checkout by `make install-plugins`). Lesson: treat a worktree's UI failures as suspect until reproduced in the main checkout, because the worktree's plugin set is not guaranteed to match.
 - ~~Every `make` target aborts with `.env:6: *** missing separator`~~ **Fixed by the user (2026-07-24)** — `make` now parses in the checkout. Worth keeping in mind: the env layering is intentional (`.env` global, `-include .env.$(ENV)` per-environment, `ENV` set by the generated env-suffixed remote targets like `make remote-install-prod`), but because `.env` is pulled in with `-include` it must be valid **makefile** syntax as well as valid dotenv — so a leading tab, a multi-line value, or a line without `=` takes down every target at once. Worktrees mask it, since `worktree-new` creates no `.env` and the include silently skips.
 - **UG1, UG2 and LD1 under `tests/ui/post/` now pass** — they had been failing only because this branch predated `e17a5dc` ("block submit on unfinished photo uploads; un-squeeze EXIF portraits in lightbox"). Merging `user/main` in brought the upload gate and the oriented-derivative slide dims those specs assert, and all three went green with no product change. A first pass mistook them for live defects; the lesson is to check the submodule branch point before reading a red spec on a feature branch as a real bug.
 ## Goal Capsule
@@ -45,7 +60,7 @@ The only way to set a coordinate today is the GPS button (reads live position) o
 - R5. Lookup is explicit-click only. While in flight, the button shows a disabled "Searching…" state that always re-enables on response, no-match, or network failure.
 - R6. Clicking with both City and Country empty is treated as a no-match: an inline hint asks for a city or country first, and no request is sent.
 - R7. Multiple matches render as a clickable list (place name, admin region, country), built via `document.createElement` + `.textContent` (no `innerHTML`), matching every other dynamic-content construction already in `post-form.js`. Clicking an entry sets `lat`/`lng` and the pin only — it never writes back to City/Country. The list hides again until the next lookup.
- R8. No matches renders an inline hint suggesting a country or manual pin drag; a network failure degrades silently (fields untouched), consistent with the existing reverse-geocode/weather error handling in `post-form.js`.
+- R8. No matches renders an inline hint suggesting a country or manual pin drag; a network failure (or a non-2xx response) leaves the fields untouched and renders a *distinct* inline hint naming the connection as the problem. **Revised in code review 2026-07-24** from "degrades silently" — silence was indistinguishable from a broken button, and the two failure modes need different messages.
 **Map preview & sync**
 - R9. A single MapLibre GL map with one draggable marker (≥44×44px touch target) renders in the panel, reusing the site's existing style URL (`MAP_STYLE`, extracted to a shared `user/themes/intotheeast/js/src/map-style.js` module per KTD1). The map instance is created once, on the panel's first open, held in module scope, and reused (with an explicit `.resize()` call) on every subsequent open — the container sits under `display:none` while closed, so the first paint would otherwise get a zero-size canvas.
@@ -54,7 +69,7 @@ The only way to set a coordinate today is the GPS button (reads live position) o
 - R12. No pin is shown until one of the four paths above sets a value for the first time.
 **Error handling & validation boundary**
- R13. Invalid manual `lat`/`lng` text is never client-blocked — the visual mismatch flag (R11) is the only feedback. Final enforcement stays server-side in `cleanCoordinate()`, which already throws on a non-blank, still-invalid value after cleaning.
+- R13. Invalid manual `lat`/`lng` text raises the visual mismatch flag (R11), **and** an unresolved flag blocks submit. **Revised in code review 2026-07-24** from "never client-blocked". The original wording deferred all enforcement to a server-side `cleanCoordinate()` described as already shipped — it was not committed anywhere, so no layer validated coordinates. It now ships in `cache-on-save.php` (both the `/post` form and the Admin2/API save paths) and the client gate stays, giving real defence in depth. The client parse is intentionally stricter than the server's `is_numeric` (whole-value decimals only, so `48,85` / `35.0116S` / `48abc` are rejected rather than prefix-parsed).
 - R14. Geolocation permission denial keeps its existing, unmodified `#location-status` error behavior.
 ### Scope Boundaries
@@ -64,8 +64,8 @@ Backend sanitization has already been added (`user/plugins/cache-on-save/cache-o
 ### Error handling
 - No search results: inline message under the search box, map/pin untouched.
- Search network failure: silent-ish degrade (consistent with existing weather/reverse-geocode error handling in `post-form.js`), fields untouched.
+- Search network failure: fields untouched, and an inline hint says the lookup service could not be reached (distinct from the no-results message, which means the service answered). **Revised in code review 2026-07-24** — this originally said "silent-ish degrade", which in practice left the DOM byte-identical to the pre-click state, so a traveller on flaky mobile data could not tell a failed lookup from a broken button. A non-2xx response is also now treated as a failure rather than parsed as an empty result set.
- Invalid manual `lat`/`lng` text: no client-side hard block (the map preview and eventual server-side `cleanCoordinate()` are the safety nets); this UI's whole point is to make that failure mode rare in practice, not to duplicate the backend validator client-side.
+- Invalid manual `lat`/`lng` text: the visual mismatch flag is the primary feedback, **and** an unresolved flag blocks submit. **Revised in code review 2026-07-24** — this originally said "no client-side hard block", on the stated grounds that server-side `cleanCoordinate()` was already the safety net. It was not: `cleanCoordinate()` had never been committed, so nothing validated coordinates anywhere. It now ships (`cache-on-save.php`, both the `/post` and Admin2 paths), so the two are genuine defence in depth rather than one imaginary net. Client-side parsing is deliberately *stricter* than the server's `is_numeric` (whole-value decimals only), which is the safe direction for a mismatch.
 - Geolocation permission denied: unchanged existing behavior (`#location-status` error message).
 ## Out of scope / explicitly deferred
@@ -102,8 +102,22 @@ Claims were checked against, not assumed from:
 | `entry-actions` routes | `user/plugins/entry-actions/entry-actions.php:63-73` |
 | `make` targets + env guard | `Makefile` (`guard-env:41-43`, `make-env-target:45-46`) |
 | `travel-memories` removal | `git log -- services/` → `a80b0a9`; `docker compose build` failure |
 | Plan status vs reality | `user/` HEAD `dd19995` |
-The `user/` submodule was moved off the outer repo's pin to its real HEAD (`dd19995`) before
+## The audit baseline moved twice
-auditing, because the pin lagged and would have produced findings against a state that is no longer
+
-current.
+Both times, auditing the convenient state rather than the real one would have produced wrong findings.
 **The submodule pin lagged.** A fresh worktree checks out the `user/` commit the outer repo pins, not
 `user/`'s real HEAD. The pin predated the merged location-override work, so auditing it would have
 reported a feature as unbuilt and missed two new source files. `user/` was moved to its real HEAD
 (`dd19995`) before auditing, and the gitlink deliberately not committed.
 **The outer `main` advanced 13 commits mid-audit.** The location-override branch was merged into the
 outer repo while this pass was running, which independently fixed two of the findings — the
 single-map-path carve-out (`829325c`) and the plan's `Status:` line (`a517331`). Merging `main` in
 before opening the PR was what surfaced that; without it this branch would have **reverted** both.
 `main`'s wording was better than the replacement drafted here and was kept in full. `main` touched none
 of the other nine corrected documents, so the remaining findings stand unchanged.
 The general rule: **re-check the baseline before publishing, not only before starting.** A long audit
 races the work it is auditing.
@@ -59,7 +59,10 @@ check_grep "location_country field present" "name: location_country"
 check_grep "weather_desc field present"     "name: weather_desc"
 check_grep "weather_temp_c field present"   "name: weather_temp_c"
 check_grep "transport_mode field present"   "name: transport_mode"
-check_grep "hero_image field present"       "name: hero_image"
+# No hero_image assertion: the field was deliberately dropped in 8cf1145 —
 # entries render their hero from the first photo, so an explicit filename was
 # redundant (see the comment at that spot in post-form.md). This check outlived
 # the field and had been failing ever since.
 check_grep "force_connect field present"    "name: force_connect"
 check_grep "featured field present"         "name: featured"
@@ -2,6 +2,58 @@ const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
 /**
 * Fail fast if the server under test does not serve the `user/` tree the specs
 * read from disk.
 *
 * This mismatch is silent and destructive. Every post spec submits through the
 * live form (the write target is derived server-side from site.yaml
 * `active_trip`, so there is no per-request override), then asserts and cleans up
 * on disk via helpers' USER_DIR. Run the specs from a worktree whose own
 * container is down and baseURL falls back to localhost:8081 — the MAIN
 * checkout — so entries get created in one content tree while cleanup deletes
 * from another. The entries are then left behind in real trip content, which is
 * exactly what happened on 2026-07-24.
 *
 * Docker is the only thing that knows the mapping, so this is best-effort: if we
 * cannot determine it we warn and continue rather than blocking non-Docker runs.
 * But when we CAN determine it and it disagrees, that is always a bug.
 */
 function assertServerServesUserDir(baseURL, userDir) {
    const port = new URL(baseURL).port || '80';
    let mountedUserDir;
    try {
        const container = execSync("docker ps --format '{{.Names}}\t{{.Ports}}'", { encoding: 'utf-8' })
            .split('\n').filter(Boolean)
            .find(l => l.includes(`:${port}->`));
        if (!container) {
            console.warn(`[setup] no running container publishes port ${port} — is the dev server up? (make start)`);
            return;
        }
        const name = container.split('\t')[0];
        mountedUserDir = execSync(
            `docker inspect ${name} --format '{{range .Mounts}}{{if eq .Destination "/var/www/html/user"}}{{.Source}}{{end}}{{end}}'`,
            { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }
        ).trim();
        if (!mountedUserDir) return; // no bind mount to compare against
    } catch (_) {
        return; // docker unavailable — nothing to check
    }
    const served = fs.realpathSync(mountedUserDir);
    const asserted = fs.realpathSync(userDir);
    if (served !== asserted) {
        throw new Error(
            `Test target mismatch — refusing to run.\n` +
            `  baseURL ${baseURL} is served from: ${served}\n` +
            `  but the specs read/clean up:       ${asserted}\n` +
            `Entries would be created in one tree and cleanup would miss them, leaving\n` +
            `test entries behind in real content. Start this checkout's own server\n` +
            `(make start) and point the run at it, e.g. GRAV_BASE_URL=http://localhost:<port>.`
        );
    }
 }
 module.exports = async function globalSetup() {
    const envFile = path.join(__dirname, '../.env');
    if (fs.existsSync(envFile)) {
@@ -23,4 +75,9 @@ module.exports = async function globalSetup() {
    // Ensure demo content is loaded (italy-2026-demo trip + stories + GPX files)
    execSync('make demo-load', { cwd: path.join(__dirname, '..'), stdio: 'inherit' });
    // Required last: helpers.js resolves USER_DIR at require time, and the .env
    // load above can supply GRAV_USER_DIR.
    const { USER_DIR } = require('./ui/helpers');
    assertServerServesUserDir(process.env.GRAV_BASE_URL || 'http://localhost:8081', USER_DIR);
 };
@@ -1,57 +1,44 @@
 const fs   = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
-function resolveUserDir() {
+// Reuse the specs' own resolution rather than reimplementing it. The previous
-    if (process.env.GRAV_USER_DIR) return process.env.GRAV_USER_DIR;
+// version of this file derived the dailies directory from a `parent:` key in
-    try {
+// pages/02.post/post-form.md — a key that was deliberately removed (the write
-        const raw = execSync(
+// target is injected server-side from site.yaml `active_trip`, and CLAUDE.md
-            "docker inspect intotheeast_grav --format '{{range .Mounts}}{{if eq .Destination \"/var/www/html/user\"}}{{.Source}}{{end}}{{end}}'",
+// forbids re-adding a static parent). The regex therefore never matched,
-            { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }
+// dailiesDir was always null, and the dailies sweep below silently did nothing.
-        ).trim();
+// That is how ui-test entries survived into the active trip's content.
-        if (raw) return raw;
+// removeEntryDir handles the root-owned case by deleting through the container —
-    } catch (_) {}
+// see its comment. Plain fs.rmSync cannot remove what Grav's Apache wrote.
-    return path.join(__dirname, '../user');
+const { USER_DIR, TRACKER_DIR, removeEntryDir } = require('./ui/helpers');
 }
 function sweepUiTestEntries(dir) {
-    if (!fs.existsSync(dir)) return 0;
+    if (!dir || !fs.existsSync(dir)) return 0;
-    const entries = fs.readdirSync(dir).filter(e => e.includes('ui-test'));
+    const found = fs.readdirSync(dir).filter(e => e.includes('ui-test'));
-    entries.forEach(e => fs.rmSync(path.join(dir, e), { recursive: true, force: true }));
+    let removed = 0;
-    return entries.length;
+    found.forEach(e => {
        const target = path.join(dir, e);
        try {
            removeEntryDir(target);
            removed++;
        } catch (err) {
            // Loud, not silent — a swallowed failure here is exactly what let a
            // ui-test entry survive into the active trip's content.
            console.error(`[teardown] COULD NOT REMOVE ${target}: ${err.message}`);
        }
    });
    return removed;
 }
 module.exports = async function globalTeardown() {
-    const userDir = resolveUserDir();
+    // Sweep both the post inbox and the active trip's dailies.
-
+    const n1 = sweepUiTestEntries(path.join(USER_DIR, 'pages/02.post'));
-    // Read active trip slug from post-form.md
+    const n2 = sweepUiTestEntries(TRACKER_DIR);
    const postFormPath = path.join(userDir, 'pages/02.post/post-form.md');
    let dailiesDir = null;
    if (fs.existsSync(postFormPath)) {
        const content = fs.readFileSync(postFormPath, 'utf-8');
        const m = content.match(/parent:\s*['"]?\/trips\/([^/'"]+)\/dailies/);
        if (m) {
            const tripSlug = m[1];
            const tripsBase = path.join(userDir, 'pages/01.trips');
            const tripFolder = fs.readdirSync(tripsBase).find(
                f => f === tripSlug || f.endsWith('.' + tripSlug) || f.includes(tripSlug)
            );
            if (tripFolder) {
                const dailiesBase = path.join(tripsBase, tripFolder);
                const dailiesFolder = fs.readdirSync(dailiesBase).find(
                    f => f === 'dailies' || f === '01.dailies' || f.endsWith('.dailies')
                );
                if (dailiesFolder) dailiesDir = path.join(dailiesBase, dailiesFolder);
            }
        }
    }
    // Sweep both the post inbox and the active trip's dailies
    const postInbox = path.join(userDir, 'pages/02.post');
    const n1 = sweepUiTestEntries(postInbox);
    const n2 = dailiesDir ? sweepUiTestEntries(dailiesDir) : 0;
    if (n1 + n2 > 0) {
-        console.log(`[teardown] removed ${n1} ui-test entries from 02.post, ${n2} from dailies`);
+        console.log(
            `[teardown] removed ${n1} ui-test entries from 02.post, ` +
            `${n2} from ${path.relative(USER_DIR, TRACKER_DIR)}`
        );
    }
 };
@@ -170,6 +170,60 @@ async function createPhotoEntry(page, tag, { content, publish = true, created }
        'Entry posted successfully!', { timeout: 15_000 });
 }
 /**
 * Resolve the Grav container that serves USER_DIR, so cleanup can delete as root.
 * Prefers GRAV_CONTAINER (set by .worktree-env / .env), else matches on the bind
 * mount so a worktree never picks the main checkout's container.
 */
 function resolveGravContainer() {
    if (process.env.GRAV_CONTAINER) return process.env.GRAV_CONTAINER;
    try {
        const want = fs.realpathSync(USER_DIR);
        const names = execSync("docker ps --format '{{.Names}}'", { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] })
            .split('\n').filter(Boolean);
        return names.find((n) => {
            const src = execSync(
                `docker inspect ${n} --format '{{range .Mounts}}{{if eq .Destination "/var/www/html/user"}}{{.Source}}{{end}}{{end}}'`,
                { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }
            ).trim();
            return src && fs.realpathSync(src) === want;
        }) || null;
    } catch (_) {
        return null;
    }
 }
 /**
 * Delete an entry directory, falling back to the container when the host cannot.
 *
 * Grav's Apache workers run as root, so every entry the form creates is
 * root-owned. Removing one recursively needs write permission on that directory,
 * which the host user does not have — so a plain fs.rmSync throws EACCES and the
 * entry survives. That is how a ui-test entry ended up committed-adjacent in the
 * active trip's content on 2026-07-24: cleanup had never actually worked for
 * form-created entries, it just failed inside a path nothing checked.
 *
 * `docker exec … rm -rf` runs as root in the container, which can remove them.
 */
 function removeEntryDir(dir) {
    try {
        fs.rmSync(dir, { recursive: true });
        return true;
    } catch (err) {
        if (err.code !== 'EACCES' && err.code !== 'EPERM') throw err;
    }
    const container = resolveGravContainer();
    if (!container) {
        throw new Error(
            `Cannot remove ${dir}: it is root-owned (written by Grav in the container) and no ` +
            `matching container was found to delete it as root. Set GRAV_CONTAINER or remove it manually.`
        );
    }
    execSync(`docker exec ${container} rm -rf '/var/www/html/user/${path.relative(USER_DIR, dir)}'`,
        { stdio: ['pipe', 'pipe', 'pipe'] });
    return true;
 }
 /**
 * Find a tracker entry folder by a unique slug fragment, then delete it.
 */
@@ -179,7 +233,7 @@ function cleanupEntry(slugFragment) {
    const entries = fs.readdirSync(TRACKER_DIR);
    const match = entries.find(e => e.includes(slugFragment));
    if (match) {
-        fs.rmSync(path.join(TRACKER_DIR, match), { recursive: true });
+        removeEntryDir(path.join(TRACKER_DIR, match));
    }
 }
@@ -202,4 +256,7 @@ function readEntryMd(entryDir) {
    return fs.readFileSync(path.join(entryDir, name), 'utf-8');
 }
-module.exports = { fillEditor, waitForPhotoUpload, postEntry, createPhotoEntry, cleanupEntry, findEntry, readEntryMd, TEST_PHOTO, TRACKER_DIR, ACTIVE_TRIP_URL };
+// USER_DIR is exported so global-setup/global-teardown resolve the same tree the
 // specs assert against, instead of keeping their own (previously divergent) copy
 // of this logic.
 module.exports = { fillEditor, waitForPhotoUpload, postEntry, createPhotoEntry, cleanupEntry, removeEntryDir, findEntry, readEntryMd, TEST_PHOTO, USER_DIR, TRACKER_DIR, ACTIVE_TRIP_URL };
@@ -9,6 +9,10 @@
 // display EXIF-rotated. For a stored-landscape portrait photo the attrs said
 // landscape while the pixels rendered portrait → PhotoSwipe squeezed them.
 //
 // Fixed in e17a5dc: slides now link a 2000px fit-within derivative and measure
 // THAT file, and derivatives are re-encoded upright, so the attrs and the
 // rendered pixels agree.
 //
 // The invariant tested here is environment-proof: whatever file the slide
 // links to, its browser-rendered natural size must equal the data-pswp-*
 // attrs. (Whether the photo ALSO displays upright depends on the server's
@@ -24,10 +28,14 @@ const { test, expect } = require('@playwright/test');
 const path = require('path');
 const fs = require('fs');
 const { execSync } = require('child_process');
 // USER_DIR comes from helpers so GRAV_USER_DIR is honoured — without it a run
 // against a checkout detached from the served tree plants the fixture in a
 // different user/ than Grav renders, and LD1 fails as an opaque "card never
 // appeared" timeout.
 const { USER_DIR } = require('../helpers');
 // Stored 800x600 with EXIF Orientation=6: browsers render it 600x800 portrait.
 const EXIF_PORTRAIT = path.join(__dirname, '../../fixtures/test-photo-exif-portrait.jpg');
 const USER_DIR = path.join(__dirname, '../../../user');
 const DEMO_DAILIES = path.join(USER_DIR, 'pages/01.trips/italy-2026-demo/01.dailies');
 const DEMO_TRIP_URL = '/trips/italy-2026-demo';
@@ -0,0 +1,404 @@
 // @ts-check
 // Tests: post form "More location details" — search-by-city lookup + draggable
 // map pin preview for setting an entry's coordinates without live GPS.
 // Covers R4-R14. The Open-Meteo geocoding endpoint is mocked via page.route()
 // so this suite is hermetic (no live third-party call, no rate-limit flakiness).
 const { test, expect } = require('@playwright/test');
 const path = require('path');
 const { fillEditor, waitForPhotoUpload, cleanupEntry, findEntry, readEntryMd, TEST_PHOTO } = require('../helpers');
 const GEOCODE_URL = '**/geocoding-api.open-meteo.com/v1/search**';
 const created = [];
 test.afterAll(() => { created.forEach(cleanupEntry); });
 // Real-API-shaped fixtures (verified live against geocoding-api.open-meteo.com).
 const KYOTO_RESULTS = {
    results: [
        { name: 'Kyoto', latitude: 35.0116, longitude: 135.7681, admin1: 'Kyoto Prefecture', country: 'Japan' }
    ]
 };
 // Mirrors the design doc's verified live Paris query: Île-de-France (France)
 // first from the API, then five US states — Texas among them, in admin1 (the
 // API's `country` field is "United States" for all of the US matches, so the
 // ranking must also check admin1 to disambiguate on a US state name).
 const PARIS_RESULTS = {
    results: [
        { name: 'Paris', latitude: 48.85341, longitude: 2.3488, admin1: 'Île-de-France Region', country: 'France' },
        { name: 'Paris', latitude: 33.66094, longitude: -95.55551, admin1: 'Texas', country: 'United States' },
        { name: 'Paris', latitude: 36.302, longitude: -88.32671, admin1: 'Tennessee', country: 'United States' },
        { name: 'Paris', latitude: 38.2098, longitude: -84.2529, admin1: 'Kentucky', country: 'United States' },
        { name: 'Paris', latitude: 39.6112, longitude: -87.6961, admin1: 'Illinois', country: 'United States' }
    ]
 };
 function mockGeocode(page, body) {
    return page.route(GEOCODE_URL, (route) => route.fulfill({
        status: 200,
        contentType: 'application/json',
        body: JSON.stringify(body)
    }));
 }
 async function openLocationDetails(page) {
    await page.locator('.location-details__summary').click();
    await expect(page.locator('.location-details')).toHaveJSProperty('open', true);
 }
 // ── Panel closed by default (R1) ────────────────────────────────────────────
 test('More location details is closed by default and holds the relocated lat/lng fields', async ({ page }) => {
    await page.goto('/post');
    const details = page.locator('.location-details');
    await expect(details).toBeAttached();
    await expect(details).toHaveJSProperty('open', false);
    await expect(page.locator('.location-details input[name="data[lat]"]')).toBeAttached();
    await expect(page.locator('.location-details input[name="data[lng]"]')).toBeAttached();
 });
 // ── R6: empty City + Country sends no request ───────────────────────────────
 test('R6: clicking lookup with City and Country both empty sends no request', async ({ page }) => {
    await page.goto('/post');
    let requested = false;
    await page.route(GEOCODE_URL, (route) => { requested = true; route.abort(); });
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    await expect(page.locator('#location-search-hint')).toContainText(/city or country/i);
    expect(requested).toBe(false);
 });
 // ── R7: a search result sets lat/lng only, never City/Country ──────────────
 test('R7: clicking a search result sets lat/lng and leaves City/Country untouched', async ({ page }) => {
    await page.goto('/post');
    await mockGeocode(page, KYOTO_RESULTS);
    await page.fill('input[name="data[location_city]"]', 'Kyoto');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    const results = page.locator('.location-search-results li button');
    await expect(results).toHaveCount(1);
    await results.first().click();
    await expect(page.locator('input[name="data[lat]"]')).toHaveValue('35.011600');
    await expect(page.locator('input[name="data[lng]"]')).toHaveValue('135.768100');
    await expect(page.locator('input[name="data[location_city]"]')).toHaveValue('Kyoto');
    await expect(page.locator('input[name="data[location_country]"]')).toHaveValue('');
    // R7: the list hides again until the next lookup.
    await expect(page.locator('.location-search-results li')).toHaveCount(0);
 });
 // ── R4/KTD2: Paris/Texas disambiguation ranks the Texas match first ─────────
 test('disambiguation: City "Paris" + Country "Texas" ranks the Texas match first', async ({ page }) => {
    await page.goto('/post');
    let requestedUrl = null;
    await page.route(GEOCODE_URL, (route) => {
        requestedUrl = route.request().url();
        route.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify(PARIS_RESULTS) });
    });
    await page.fill('input[name="data[location_city]"]', 'Paris');
    await page.fill('input[name="data[location_country]"]', 'Texas');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    const results = page.locator('.location-search-results li button');
    await expect(results).toHaveCount(5);
    await expect(results.first()).toContainText('Texas');
    // R4: Country is never concatenated into the query string.
    expect(requestedUrl).toContain('name=Paris');
    expect(requestedUrl).not.toContain('Texas');
 });
 // ── R8: no matches shows the inline hint, fields untouched ─────────────────
 test('R8: no matches shows the no-match hint and leaves fields untouched', async ({ page }) => {
    await page.goto('/post');
    await mockGeocode(page, { results: [] });
    await page.fill('input[name="data[location_city]"]', 'Nowheresville');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    await expect(page.locator('#location-search-hint')).toContainText(/no matches/i);
    await expect(page.locator('input[name="data[lat]"]')).toHaveValue('');
    await expect(page.locator('input[name="data[lng]"]')).toHaveValue('');
 });
 // ── R5: in-flight state shows "Searching…" and always re-enables ───────────
 test('R5: the lookup button shows a disabled "Searching…" state while in flight', async ({ page }) => {
    await page.goto('/post');
    await page.route(GEOCODE_URL, async (route) => {
        await new Promise((r) => setTimeout(r, 400));
        route.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify(KYOTO_RESULTS) });
    });
    await page.fill('input[name="data[location_city]"]', 'Kyoto');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    const btn = page.locator('#lookup-coords');
    await expect(btn).toBeDisabled();
    await expect(btn).toHaveText('Searching…');
    await expect(btn).toBeEnabled({ timeout: 5_000 });
    await expect(btn).toContainText('Look up coordinates');
 });
 // ── R8: a network failure degrades silently and re-enables the button ──────
 test('a network failure degrades silently, leaves fields untouched, and re-enables the button', async ({ page }) => {
    await page.goto('/post');
    await page.route(GEOCODE_URL, (route) => route.abort('failed'));
    await page.fill('input[name="data[location_city]"]', 'Kyoto');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    await expect(page.locator('#lookup-coords')).toBeEnabled();
    await expect(page.locator('input[name="data[lat]"]')).toHaveValue('');
    await expect(page.locator('input[name="data[lng]"]')).toHaveValue('');
 });
 // ── XSS safety: an API-sourced name containing markup renders as literal text ──
 test('a result name containing markup renders as literal text, not executed', async ({ page }) => {
    await page.goto('/post');
    await mockGeocode(page, {
        results: [{ name: '<img src=x onerror="window.__xss=true">', latitude: 1, longitude: 2, country: 'Nowhere' }]
    });
    await page.fill('input[name="data[location_city]"]', 'Test');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    const btn = page.locator('.location-search-results li button').first();
    await expect(btn).toContainText('<img src=x onerror="window.__xss=true">');
    expect(await btn.evaluate((el) => el.querySelector('img'))).toBeNull();
    expect(await page.evaluate(() => window.__xss)).toBeUndefined();
 });
 // ── U4: map renders exactly one canvas, no pin until a coordinate is set ───
 test('opening the panel renders exactly one map canvas with no initial pin', async ({ page }) => {
    await page.goto('/post');
    await openLocationDetails(page);
    await expect(page.locator('#location-map canvas.maplibregl-canvas')).toHaveCount(1, { timeout: 10_000 });
    await expect(page.locator('#location-map .maplibregl-marker')).toHaveCount(0);
 });
 // ── U4: reopening does not duplicate the canvas; resize keeps it non-zero ──
 test('reopening the panel a second time leaves exactly one canvas with non-zero size', async ({ page }) => {
    await page.goto('/post');
    await openLocationDetails(page);
    await page.locator('.location-details__summary').click(); // close
    await expect(page.locator('.location-details')).toHaveJSProperty('open', false);
    await openLocationDetails(page); // reopen
    const canvases = page.locator('#location-map canvas.maplibregl-canvas');
    await expect(canvases).toHaveCount(1, { timeout: 10_000 });
    const box = await canvases.first().boundingBox();
    expect(box && box.width).toBeGreaterThan(0);
    expect(box && box.height).toBeGreaterThan(0);
 });
 // ── R11: a search pick shows a pin on the map ───────────────────────────────
 test('a search-result pick renders a pin on the map', async ({ page }) => {
    await page.goto('/post');
    await mockGeocode(page, KYOTO_RESULTS);
    await page.fill('input[name="data[location_city]"]', 'Kyoto');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    await page.locator('.location-search-results li button').first().click();
    await expect(page.locator('#location-map .maplibregl-marker')).toHaveCount(1, { timeout: 10_000 });
 });
 // ── R11: dragging the marker updates lat/lng (rounded to 6dp) ──────────────
 test('dragging the pin updates lat/lng to the drop location', async ({ page }) => {
    await page.goto('/post');
    await mockGeocode(page, KYOTO_RESULTS);
    await page.fill('input[name="data[location_city]"]', 'Kyoto');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    await page.locator('.location-search-results li button').first().click();
    const marker = page.locator('#location-map .maplibregl-marker');
    await expect(marker).toHaveCount(1, { timeout: 10_000 });
    const before = await page.locator('input[name="data[lat]"]').inputValue();
    // setPin()'s map.panTo() animates the marker into view — wait for it to
    // settle so the bounding box grabbed below matches where the marker will
    // actually be when the mouse events land.
    await page.waitForTimeout(800);
    const box = await marker.boundingBox();
    if (!box) throw new Error('marker has no bounding box');
    const startX = box.x + box.width / 2;
    const startY = box.y + box.height / 2;
    await page.mouse.move(startX, startY);
    await page.mouse.down();
    await page.mouse.move(startX + 40, startY + 30, { steps: 5 });
    await page.mouse.up();
    await expect(async () => {
        const after = await page.locator('input[name="data[lat]"]').inputValue();
        expect(after).not.toBe(before);
        expect(after).toMatch(/^-?\d+\.\d{6}$/);
    }).toPass({ timeout: 5_000 });
 });
 // ── R11/R13: typing an invalid value flags the field without crashing ──────
 test('typing an invalid lat value shows the mismatch flag and clears once fixed', async ({ page }) => {
    await page.goto('/post');
    await openLocationDetails(page);
    const latEl = page.locator('input[name="data[lat]"]');
    const lngEl = page.locator('input[name="data[lng]"]');
    await latEl.fill('not-a-number');
    await lngEl.fill('135.7681');
    await lngEl.blur();
    await expect(latEl).toHaveClass(/location-field--mismatch/);
    await expect(latEl).toHaveAttribute('aria-invalid', 'true');
    await expect(page.locator('#location-map .maplibregl-marker')).toHaveCount(0);
    await latEl.fill('35.0116');
    await latEl.blur();
    await expect(latEl).not.toHaveClass(/location-field--mismatch/);
    await expect(page.locator('#location-map .maplibregl-marker')).toHaveCount(1);
 });
 // ── U4: rapid close/reopen while the maplibre-gl chunk is still in flight must
 // not build two Map instances against the same container (code-review fix) ──
 test('rapid close/reopen before the maplibre-gl chunk resolves still leaves exactly one canvas', async ({ page }) => {
    await page.route('**/*maplibre-gl*.js', async (route) => {
        await new Promise((resolve) => setTimeout(resolve, 500));
        await route.continue();
    });
    await page.goto('/post');
    // Open, then immediately close and reopen — both toggles land while the
    // delayed chunk request above is still pending.
    await page.locator('.location-details__summary').click();
    await page.locator('.location-details__summary').click();
    await page.locator('.location-details__summary').click();
    await expect(page.locator('.location-details')).toHaveJSProperty('open', true);
    await expect(page.locator('#location-map canvas.maplibregl-canvas')).toHaveCount(1, { timeout: 10_000 });
 });
 // ── U5: blanking both fields after a mismatch was flagged clears the flag ──
 test('blanking both lat/lng fields after a mismatch clears the flag', async ({ page }) => {
    await page.goto('/post');
    await openLocationDetails(page);
    const latEl = page.locator('input[name="data[lat]"]');
    const lngEl = page.locator('input[name="data[lng]"]');
    await latEl.fill('not-a-number');
    await lngEl.blur();
    await expect(latEl).toHaveClass(/location-field--mismatch/);
    await latEl.fill('');
    await lngEl.fill('');
    await lngEl.blur();
    await expect(latEl).not.toHaveClass(/location-field--mismatch/);
    await expect(lngEl).not.toHaveClass(/location-field--mismatch/);
 });
 // ── U5: a flagged, unresolved lat/lng must block submit (code-review fix) ──
 test('submitting with an unresolved lat/lng mismatch is blocked', async ({ page }) => {
    const tag = `loc-mismatch-${Date.now()}`;
    await page.goto('/post');
    await page.fill('input[name="data[title]"]', `UI Test ${tag}`);
    await fillEditor(page, 'Location-override mismatch-blocks-submit guard. Safe to delete.');
    await page.locator('input.filepond--browser').setInputFiles(TEST_PHOTO);
    await waitForPhotoUpload(page);
    await openLocationDetails(page);
    const latEl = page.locator('input[name="data[lat]"]');
    const lngEl = page.locator('input[name="data[lng]"]');
    await latEl.fill('999');
    await lngEl.fill('999');
    await lngEl.blur();
    await expect(latEl).toHaveClass(/location-field--mismatch/);
    // Register for cleanup BEFORE the click: if the gate ever regresses, the
    // entry lands on disk and the afterAll hook must still see the tag.
    created.push(tag);
    await page.locator('.btn-post').evaluate((el) => el.click());
    // `.notices` toHaveCount(0) and toHaveURL(/\/post/) both pass instantly and
    // both also hold for a SUCCESSFUL submit (the form posts to /post and only
    // renders its notice after the round trip), so neither can distinguish a
    // working gate from a regressed one. Prove the negative on disk instead,
    // after giving a regressed submit time to actually write.
    await page.waitForTimeout(2000);
    expect(findEntry(tag), 'a flagged coordinate must never reach the server').toBeFalsy();
    // And prove the block was the gate's doing: still flagged, value untouched.
    await expect(latEl).toHaveClass(/location-field--mismatch/);
    await expect(latEl).toHaveValue('999');
 });
 // ── U4: lazy-load boundary — an ordinary GPS-only submit never fetches maplibre-gl ──
 // The URL pattern deliberately covers BOTH halves of the lazy boundary: the JS
 // chunk (js/post/maplibre-gl-*.js) and the stylesheet
 // (css-compiled/maplibre-gl.css, <link>ed by location-map.js at panel-open —
 // see its ensureMaplibreCss). Neither may be requested when the panel stays shut.
 test('an ordinary submit without opening the panel never fetches the maplibre-gl chunk', async ({ page }) => {
    const chunkRequests = [];
    page.on('request', (req) => {
        if (/maplibre-gl/.test(req.url())) chunkRequests.push(req.url());
    });
    const tag = `loc-nomap-${Date.now()}`;
    await page.goto('/post');
    await page.fill('input[name="data[title]"]', `UI Test ${tag}`);
    await fillEditor(page, 'Location-override lazy-load guard. Safe to delete.');
    await page.locator('input.filepond--browser').setInputFiles(TEST_PHOTO);
    await waitForPhotoUpload(page);
    await page.locator('.btn-post').evaluate((el) => el.click());
    await expect(page.locator('.notices')).toContainText('Entry posted successfully!', { timeout: 15_000 });
    created.push(tag);
    expect(chunkRequests, 'neither the maplibre-gl chunk nor its stylesheet may be fetched when the panel is never opened').toHaveLength(0);
 });
 // ── The other half of that boundary: opening the panel DOES apply the vendor CSS ──
 // Without this, the guard above could keep passing while the stylesheet silently
 // stopped loading at all (a broken href, a missed build step), leaving the map
 // unstyled with nothing to catch it. Asserts the <link> exists AND parsed —
 // link.sheet is null until the browser has actually applied it.
 test('opening the panel lazily links maplibre\'s stylesheet and applies it', async ({ page }) => {
    await page.goto('/post');
    const hrefBefore = await page.evaluate(() => Array.from(document.styleSheets)
        .map((s) => s.href || '').filter((h) => /maplibre-gl\.css/.test(h)));
    expect(hrefBefore, 'the vendor stylesheet must not be present before the panel opens').toHaveLength(0);
    await openLocationDetails(page);
    await expect(page.locator('#location-map canvas.maplibregl-canvas')).toHaveCount(1, { timeout: 10_000 });
    await expect.poll(
        () => page.evaluate(() => {
            const link = Array.from(document.querySelectorAll('link[rel="stylesheet"]'))
                .find((l) => /maplibre-gl\.css/.test(l.href));
            return link ? link.sheet !== null : false;
        }),
        { message: 'maplibre\'s stylesheet must be linked and applied once the panel opens', timeout: 10_000 }
    ).toBe(true);
 });
 // ── Full submit: a search-picked location round-trips into the frontmatter ──
 test('a full submit with a search-picked location saves the expected lat/lng', async ({ page }) => {
    const tag = `loc-submit-${Date.now()}`;
    await page.goto('/post');
    await mockGeocode(page, KYOTO_RESULTS);
    await page.fill('input[name="data[title]"]', `UI Test ${tag}`);
    await fillEditor(page, 'Location-override submit test. Safe to delete.');
    await page.fill('input[name="data[location_city]"]', 'Kyoto');
    await openLocationDetails(page);
    await page.click('#lookup-coords');
    await page.locator('.location-search-results li button').first().click();
    await page.locator('input.filepond--browser').setInputFiles(TEST_PHOTO);
    await waitForPhotoUpload(page);
    await page.locator('.btn-post').evaluate((el) => el.click());
    await expect(page.locator('.notices')).toContainText('Entry posted successfully!', { timeout: 15_000 });
    created.push(tag);
    const entryDir = findEntry(tag);
    expect(entryDir, 'Entry folder should exist on disk').toBeTruthy();
    const md = readEntryMd(entryDir);
    expect(md).toContain('35.0116');
    expect(md).toContain('135.7681');
 });
@@ -12,6 +12,12 @@
 //    silent-data-loss path.
 // post-form.js owns the complete gate (theme code; the form plugin is
 // GPM-managed and not patchable in-repo).
 //
 // The gate lives in e17a5dc: submit is blocked unless EVERY FilePond item is
 // processing-complete, with distinct messages for the failed and still-uploading
 // cases. Both assert on .photo-convert-status, which post-form.js's setStatus()
 // creates via photoStatusEl() — so a passing expectation here proves the THEME
 // gate fired, not the form plugin's, whose own guard only raises alert().
 const { test, expect } = require('@playwright/test');
 const { fillEditor, findEntry, cleanupEntry, TEST_PHOTO } = require('../helpers');
Author	SHA1	Message	Date
m038andClaude Opus 5	086c36d157	docs(working): handover for the documentation reconciliation Two-part handover following the repo's existing convention: Part A for a fresh Claude session, Part B for the owner. Part A leads with the trap rather than the deliverables, because it is the thing most likely to cause damage: main advanced 13 commits mid-audit and had already fixed two of the audit's findings, so this branch would have reverted them without the merge. Includes the fetch-and-merge commands to re-check the baseline if main has moved again overnight. Also records, so a future session does not undo them: - The tense split — past-tense records are annotated, never rewritten. "Finishing the job" by rewriting the milestone docs or the 41 completed plans is the wrong instinct and destroys the audit trail. - One finding was WITHDRAWN during the audit (the asset table lists esbuild entry points, so imported-only sources are correctly absent). Adding them back would reintroduce a non-defect. - The known false-positive link-check hit inside a ```diff fence. - The submodule invariant: git diff main..HEAD -- user must stay empty. An earlier git reset -- user here silently reverted main's pin bump; that was caught, and the check is written down so it is not re-broken. - P5's booby trap: removing shortcode-gallery-plusplus may take shortcode-core with it and break stories. Part B is the two things only the owner can do: one command to open the PR (tea needs an interactive TTY), and the 7 recommendation decisions with why each needs a human. Notes that the PR body file lives in a Claude job dir and is reconstructable from the spec if it has been cleaned up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-25 01:10:38 +02:00
m038andClaude Opus 5	7c9c140a1b	Merge main into feat/docs-reconcile; defer to main on two overlapping fixes main advanced 13 commits while this documentation audit ran — the location-override work was merged into the outer repo — and it independently fixed two of the audit's findings. Without this merge the branch would have REVERTED them, which is the worst outcome for a cleanup pass because it arrives disguised as an improvement. Both conflicts resolved in main's favour; main's wording was better informed: - CLAUDE.md, the single-map-path rule: main's carve-out (`829325c`) states the exception as its own top-level bullet, names MAP_STYLE as the one shared thing, and spells out both prohibitions ("do not fold it into initEntryMap", "do not add a third path"). Taken verbatim over the version drafted here. - 2026-07-23-post-form-location-override.md: main (`a517331`) had already set the status to Complete, with far richer detail — the multi-agent review findings, the green-run numbers, the DEL4 regression still open, and the merge SHAs. Taken in full; the audit's claim that the status "lagged" was dropped, since it was true only of this branch's older branch point. Submodule pin: main bumped user/ to dd19995 and this merge preserves that. The audit's own no-gitlink-commit discipline applies to bumping the pin as a side effect of routine work, not to discarding a bump main already made. main touched none of the other nine corrected documents, so the remaining 18 findings stand unchanged. Audit notes corrected to match reality rather than left overstated: - superseded-decisions.md R13 now dates the carve-out to 2026-07-24 (`829325c`) rather than implying this pass introduced it. - The reconciliation spec gains an "audit baseline moved twice" section: the submodule pin lagged real HEAD, and then the base branch advanced mid-audit. - The compounded learning's section 6 is rewritten from "audit the current state" to "re-check the baseline before publishing, not only before starting", with the two habits that actually follow: merge the base branch in before opening the PR and read conflicts as findings, and when the incoming version is better, take it wholesale. An audit has no special authority over the work it audits. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-25 00:21:47 +02:00
m038andClaude Opus 5	d946eaaa7e	docs(solutions): compound the doc-reconciliation learnings; grow CONCEPTS.md Captures the durable learnings from the 2026-07-25 whole-repo documentation reconciliation as a knowledge-track learning, plus the vocabulary it introduced. New learning — conventions/reconciling-drifted-docs-tense-tiering-and-a-supersession-ledger.md: - Tier docs by TENSE, not only by content type. claude-md-content-tiering.md established "descriptions drift, rules don't" and tiered by content type; that axis could not say what to do with 41 completed plans, which are neither rules nor current descriptions. Present-tense docs are defects when stale; past-tense records are supposed to be stale and get annotated, never rewritten. - Ledger AND inline notes, because each covers the other's failure: a ledger alone is a pointer you may not follow, inline notes alone give no changelog view. Prefer annotation patterns the repo already uses. - Record what was NOT reversed, or a ledger of only reversals makes every old doc look suspect and settled decisions get re-litigated. - Separate "docs are wrong" from "code is wrong" — route code-side findings to a recommendations doc so a docs diff stays reviewable. - Verify against the artifact that decides behaviour: the Makefile for commands (including macro-generated targets a grep misses), the build script for outputs, imports for source-vs-output, branch history for whether a plan shipped. An audit that never withdraws a finding has not been checking itself — one finding here was withdrawn after reading package.json. - Audit the state that actually runs: a fresh worktree checks out the submodule PIN, which lagged real HEAD and would have hidden a whole merged feature. Three structural lessons in "Why This Matters": - An index describing another document's role is a factual claim that can rot, and it is worse than the stale document itself — it defeats the reader's judgement before it engages. This was the tree's single most misleading line. - Wrong beats absent again, now for commands: README's server runbook documented every remote-* target without the -test/-prod suffix guard-env requires. deploy-cycle.md had it right — the defect was a second copy drifting. - Promoting a doc to "the authoritative list of X" creates a completeness obligation it did not have as prose, and nothing enforces it. - A removal is not finished when the code is gone, but when every consumer and every description of it is gone — travel-memories left a compose service behind, hidden by a cached Docker image. Local state can mask a breakage indefinitely, so "it works here" is not evidence. Overlap with conventions/claude-md-content-tiering.md scored MODERATE (2 of 5 dimensions: same root-cause thesis, overlapping files; different tiering axis and different prevention), so a new doc was written rather than folding into it. Flagged in the Related section as a consolidation candidate if a third documentation learning appears. CONCEPTS.md — new Documentation cluster (Historical record, Superseded decision, Plan status) and one flagged ambiguity recording that a present-tense historical record is not a claim about the current system. These three are now referenced by CLAUDE.md and both doc READMEs, so they needed defining. Discoverability check: no edit needed — CLAUDE.md's entry-point table already surfaces docs/solutions/ with its frontmatter fields and CONCEPTS.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-25 00:18:36 +02:00
m038andClaude Opus 5	cfe070efec	fix(make): worktree-rm no longer unregisters user/ for the main checkout `submodule deinit` is needed before `worktree remove` (a populated user/ blocks it), but worktrees share .git/config — so deiniting inside the worktree stripped submodule.user.url globally. After any `make worktree-rm` the main checkout's `git submodule status` reported `-` (not initialised) while user/ sat there fully intact, and a later `submodule update` would have had no URL to work from. Re-register with an idempotent `submodule init` after the removal. Found by tearing down the post-location-override worktree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 23:54:43 +02:00
m038andClaude Opus 5	3250ad366a	docs(working): close the plan; retract the owner_username diagnosis Merged state recorded (user/ dd19995, outer `4450bd6`, pin bumped). The "owner_username cluster" was wrong: on merged main only DEL4 fails, with identical site.yaml and content, so auth was never the cause. The worktree's extra five failures came from its incomplete git-ignored user/plugins/ set. DEL4 itself is real and stays open — deleting an entry removes it from the DOM and from disk, but a fresh trip-page load makes the server re-emit the card, the same invalidation bug the spec's header says was fixed once before. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 23:53:24 +02:00
m038andClaude Opus 5	4450bd6eec	Merge feat/post-location-override into main Post-form location override (U1-U6) plus the code-review hardening, the maplibre-CSS lazy <link>, and the test-entry leak fix. Bumps the user pin to dd19995, the corresponding user/ merge-to-main commit. CLAUDE.md conflicted because both sides changed it deliberately: main cut it to rules-only (`839a4d0`, `ed6e43a`) while this branch added the map-doctrine carve-out (`829325c`). Resolved to main's rules-only structure with the carve-out ported into it — without it CLAUDE.md would forbid the second map engine this feature deliberately ships. The descriptive detail stays in docs/reference/architecture.md, per main's content-tiering convention. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 23:49:36 +02:00
m038andClaude Opus 5	28bbd41868	docs(working): record the submodule-git-dir cause and the .env fix ~/Projects is a symlink to ~/Nextcloud/Projects — one directory, not two clones. The differing user/main refs came from the worktree having its own submodule git dir (.git/worktrees/<name>/modules/user), which is worth knowing: submodule commits made from the main checkout stay invisible in a worktree until fetched, and a local fetch moves them without a push. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 23:47:37 +02:00
m038andClaude Opus 5	d57041d316	test(post): retract the "these specs are red" notes — the merge fixed them The warnings added in `6398542` were wrong. UG1, UG2 and LD1 were failing because this branch predated e17a5dc, not because the behaviour they assert was missing: merging user/main brought the FilePond upload gate and the oriented-derivative slide dims, and all three pass with no product change. Headers now point at e17a5dc for both mechanisms. Also corrects the plan's .env note — the env layering is intentional (.env global, .env.<ENV> per environment via the generated remote-*-<env> targets); the actual fault is just that `-include .env` additionally requires makefile-valid syntax and line 6 is not, which breaks make in both non-worktree clones. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 23:40:48 +02:00
m038andClaude Opus 5	b02f27f559	docs(working): record three real defects behind the red post specs Also corrects the green-run line: "test-post 6/6" is the scripts/test-post.sh shell suite, not the Playwright specs under tests/ui/post/ — conflating the two made the Playwright post specs look covered when they were never run. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 23:28:49 +02:00
m038andClaude Opus 5	6398542845	test(post): resolve USER_DIR via helpers; record why UG1/UG2/LD1 are red lightbox-dims.spec.js hardcoded ../../../user, so a run against a checkout detached from the served tree planted its fixture in a different user/ than Grav renders and LD1 failed as an opaque "card never appeared" timeout. Take USER_DIR from helpers instead, which honours GRAV_USER_DIR. The three specs in this folder that fail do so for real, pre-existing reasons, and both files' headers implied otherwise: - UG1/UG2 specify a submit gate that is not implemented. post-form.js's only create-form guard is `converting > 0` (pre-FilePond HEIC conversion); it never inspects FilePond item state at submit time, and .photo-convert-status is created lazily by photoStatusEl() only from the HEIC paths — so for a plain JPEG the element never exists and both expectations fail as "element(s) not found". UG2 is the one that matters: a failed upload keeping its thumbnail is unguarded silent data loss. - LD1's header described its root cause in the past tense, reading as fixed. entry-journal.html.twig:48-49 still emits {{ img.width }} / {{ img.height }}, so EXIF-rotated photos still declare pre-rotation dims and PhotoSwipe still squeezes them. Left failing rather than skipped, per retries:0 — a red test here is a real defect, and hiding these would lose both. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 23:28:18 +02:00
m038	f9ab3b1561	docs(working): record the green run, the lazy-link, and what's left before merge	2026-07-24 22:34:20 +02:00
m038	1f4e2aeba5	fix(test): close the test-entry leak into real trip content A ui-test entry had survived into the active trip's dailies. Three independent failures had to line up for that, and all three were real: 1. cleanupEntry() used host-side fs.rmSync. Grav's Apache workers run as root, so every entry the form creates is root-owned and recursive removal needs write permission on that directory — which the host user lacks. Cleanup had never worked for form-created entries; it just threw inside a path nothing checked. It now falls back to `docker exec … rm -rf` in the container that actually serves USER_DIR. 2. globalTeardown's dailies sweep keyed off a `parent:` in post-form.md — a key deliberately removed (the write target comes from site.yaml active_trip, and CLAUDE.md forbids re-adding a static parent). The regex could never match, so dailiesDir was always null and the sweep silently did nothing. It now reuses helpers' own resolution instead of keeping a divergent copy. 3. Nothing pinned the suite to this checkout's server. playwright.config.js defaults to :8081, so a worktree run hit the MAIN checkout — entries created in one content tree while the specs asserted and cleaned up in another. test-ui now passes GRAV_BASE_URL from GRAV_PORT, and globalSetup hard-fails when the server's bind mount disagrees with the tree the specs read. Also fixed, found on the way to a green run: - test-account interpolated the password into an `sh -c` string, so a password containing a shell metacharacter was re-parsed by the container's shell (`sh: 2: <fragment>: not found`, no account, every UI run dead). It now travels via `docker exec -e`, making the recipe indifferent to its contents. - `make start` in a worktree always failed: travel-memories declares `env_file: .env` and worktree-new creates none. It degrades to start-grav there — a worktree with no server is what sent runs to :8081 in the first place. - test-form-config asserted a hero_image field that 8cf1145 deliberately removed; it had been failing ever since. Verified: config 22/22, post 6/6, location-override 20/20, and a full UI run now leaves zero ui-test entries behind. The remaining UI failures are pre-existing on main — site.yaml pins owner_username to a real account while the suite logs in as testrunner, so owner-only controls never render for it. Only trip-publish.spec.js patches that; delete-flow, edit-mode and anon-view do not. Left for a separate branch.	2026-07-24 22:33:46 +02:00
m038andClaude Opus 5	5edaf3ee1e	docs(review): correct R8/R13 and the plan status; bump user pin to the review fixes R8 and R13 both described behaviour that changed in review, and R13 rested on a server-side cleanCoordinate() that had never been committed. Both now describe what actually ships, with the revision called out inline rather than silently rewritten. The plan's Status keeps ✅ Complete but now records what the review changed and the two things still open before merge. Bumps the `user` gitlink to e873a9c (the review fixes). The submodule is deliberately NOT pushed: git-sync would propagate it to production. So this pin still references a commit that exists only locally — push `user/` and re-point before this branch merges. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 21:49:02 +02:00
m038andClaude Opus 5	829325c9c7	fix(review): make the mismatch-blocks-submit test able to fail; carve out the map doctrine The U5 guard asserted only `.notices` toHaveCount(0) and toHaveURL(/\/post/). Both pass instantly, and both also hold for a successful submit — the form posts to /post and only renders its notice after the round trip, and the click is dispatched via evaluate(el => el.click()), which skips Playwright's navigation-aware waiting. So the one test standing between a bad coordinate and the server could not fail. It now proves the negative on disk via findEntry() after a settling interval, registers the tag for cleanup before the click, and asserts the flag and value survived. CLAUDE.md's "one map path" section stated flatly that a single map code path exists, which location-map.js now contradicts. Recorded it as the one sanctioned exception (an editor, not a display map; lazy-imported; shares only MAP_STYLE) rather than leaving the doctrine wrong. The `user` gitlink is deliberately NOT bumped here: its pin already points at an unpushed submodule commit, which must be pushed and re-pointed before this branch merges. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-24 21:34:17 +02:00
m038andClaude Sonnet 5	a517331d1b	fix(post): cover the code-review fixes; mark location-override plan complete Adds Playwright coverage for the four cross-reviewer-confirmed bugs fixed in the user/ submodule (map-load race on rapid reopen, mismatch flag clearing on blank, and submit blocked on unresolved mismatch), and bumps the user/ pointer to the commit with those fixes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-24 20:03:19 +02:00
m038	01c3e72c8f	test(post): add location-override Playwright coverage Mocks the Open-Meteo geocoding endpoint via page.route() so the suite is hermetic. Covers the panel's closed-by-default state, search happy path, Paris/Texas disambiguation ranking, no-match/network-failure/in-flight states, XSS-safe rendering, map canvas singleton behavior, drag sync, the mismatch flag, the maplibre-gl lazy-load boundary, and a full submit round-tripping lat/lng into the entry's frontmatter.	2026-07-24 19:38:39 +02:00