# Release 11 — release 10's follow-ups, the homepage deploy from `/sites`, umtool's brand fonts, one-core Phase 4 slice 3

`main` at `ee9d41fa` (release 10 fully rolled out as 0.9.4 on 2026-09-28 at 00:53: the five sites,
the hub `10d6946f` and the homepage `7ca70923`; the :3001 editor restart is still owed). Release 11
is the overnight session of 2026-09-28, which the operator asked for with all four candidate
bundles: the lows left by release 10, the homepage deploy from `/sites`
([`homepage-deploy-from-ui.md`](homepage-deploy-from-ui.md)), umtool's brand fonts, and one-core
Phase 4 slice 3 ([`one-core.md`](one-core.md), "Phase 4"). Rules:
`plans/tools/implementer-rules.md`, with the commit trailer this release's prompts give.

**The operator's standing choices for the night:**
- **Copy:** the three items that need words ship with **draft lines**, one marked `DRAFT`
  constant each in `export/app/ask/hubScopeCopy.ts`, for a morning ruling.
- **Merging:** each slice merges to `main` after its review. **No cut and no deploy**; an
  unattended build-deploy would publish the merged code with its `[Unreleased]` notes, and the
  operator accepts that.
- **Cleanup:** the 14 merged worktrees of releases 9–10 were removed first (55 GiB freed;
  `diet-series` kept).

## The slices

| Slice | Branch | What | Owns |
|---|---|---|---|
| O3 | `r11/runner-lows` | `resolveMaybeMissingState` reads a newer `error` probe as `maybe_missing` (+ an export check of the presence badge); a failed forced download keeps the subtitle pass's status; the `cookies-mode.spec:241` flake (keep the run log mounted); cut-release review lows L3 + L4 | `common/lib/availability*.ts`, the maybe-missing part of `buildIndex.ts`, `downloadOneManaged.ts`, `DownloadStage.tsx`, `common/controller/cutRelease.ts`, `api/ops/cut-release` |
| O4 | `r11/homepage-deploy-ui` | The homepage's build and deploy from `/sites`: three job kinds, the refusals, a Homepage section, `pnpm ops build-homepage` / `deploy-homepage` | `editor/app/sites/**`, the two new ops routes, the job-kind entries, `scripts/archilyzer-ops.mjs` verbs, `builtHomepageProblem` |
| O1 | `r11/hub-lows` | A "built-ins loaded" flag; three DRAFT copy lines (a zero-archive `/ask`, a member's missing live chat with a subs-only Retry, "Searching N of M archives"); `normalizeSocialSvg` fills children; `mcp/README.md`'s `fetch_clip` env lines | `export/app/ask/**`, `export/app/components/hub/**`, `SearchDataContext.tsx`, `siteRegistry.ts`, `normalizeSocialSvg`, `mcp/README.md` |
| O2 | `r11/homepage-lows` | A custom hex fitted per base on the homepage cards; a 6th validated chart slot; a forced-colours fallback for the mark ring; the homepage e2e fixture copy | `homepage/app/components/*`, `common/lib/siteColor.ts` / `homepageChart.ts` / `homepageChartData.ts`, `BrandMark.tsx`, the homepage e2e setup |
| O5 | `r11/umtool-fonts` | The rail, ledger and chart text in Plex Sans under the brand preset; a vendored bold IBM Plex Mono; an unbranded render byte-identical | `umtool/report-to-video/**` |
| O6 | `r11/phase-4-s3` | `archilyzer doctor`, `run <operation>`, `mcp`; `PUBLISH.md` absorbing `DEPLOY_DOCKER.md` + `DEPLOY_CLOUDFLARE.md`; the env-var docs; the `E2E_` prefix cleanup LAST | `common/bin/archilyzer.ts`, the docs, then the playwright configs + helpers |

**Waves:** O3 ‖ O4 ‖ O6 (the marathon) first; O1 ‖ O2 as the first two merge; O5 last. O6
merges `main` once O1–O5 have landed, then does its `E2E_` rename. Then one integration gate on
`main`, and the morning runbook (`~/reports/overnight-2026-09-28/MORNING.html`).

**Priority if the night runs short:** O3 > O4 > O1 > O2 > O5 > O6's remainder.

## Record

### Slice O4, as shipped — deploy the homepage from /sites (2026-09-28)

The operator's ask (2026-09-26): **"Is there a way to redeploy archilyzer.pages.dev from the UI?"**
There was not: `/sites` built and deployed the hub, and the homepage was a CLI
(`archilyzer build|deploy homepage`) with no job, no `/jobs` row and no `pnpm ops` verb. Plan:
[`homepage-deploy-from-ui.md`](homepage-deploy-from-ui.md), decisions 1–5, now with an "As shipped"
note. Branch `r11/homepage-deploy-ui` off `main` `2162db92`, worktree
`/home/user/Projects/r11-homepage-deploy-ui`, one Opus implementer. Scratch files `o4-*` in the
job's `tmp/overnight`.

**What shipped.**
- **A Homepage section on `/sites`, after Hub.** The Hub paragraph lost its homepage sentence, and
  the new section says it instead: the `homepage` package, `homepage/out`, the project `archilyzer`,
  and the same code as `archilyzer build|deploy homepage`. Its group, **Homepage build**, is
  `HubBuildButtons`' shape: **Build homepage**, **Deploy after build** (unticked), **Deploy
  homepage**, one `JobLane` at a time (**Build homepage** / **Build & deploy homepage** /
  **Deploy homepage**).
- **A preview branch box** (textbox "preview branch", empty = production). It is judged by
  `previewBranchProblem`, the function the action and the route refuse with. A bad name greys out
  Deploy homepage, and Build homepage when Deploy after build is ticked, and shows the sentence
  (`role="status"`, "preview problem").
- **One line saying what a deploy ships:** "Deploy homepage ships `homepage/out`, built <when>, to
  `archilyzer` (production): https://archilyzer.pages.dev." (`PROJECT_URL`). With no build it says
  "`homepage/out` holds no build yet …". With a preview it gives the alias and says "the live site
  is left alone". Under it: the homepage reads the index as it stands, so run Build index first.
- **Three job kinds,** via `runManagedFunction` in `editor/app/sites/lib/homepageDeployActions.ts`:
  - `build-homepage` on queue `build`;
  - `deploy-homepage` and `build-deploy-homepage` on queue `deploy`;
  - the bodies are `buildHomepage` / `deployHomepage`, unchanged. The build-deploy deploys only
    on exit 0.
- **Refusals before any job:** a bad preview name, and for a deploy-only,
  `builtHomepageProblem(homepageOutDir(paths))` ("homepage/out holds no build — build the homepage
  first"). `deployHomepage` re-checks both inside the job with its own sentences, untouched.
- **Ops:**
  - `/api/ops/build-homepage` `{deploy?, preview?}`: a preview without deploy is a 400.
  - `/api/ops/deploy-homepage` `{preview?}` answers `previewUrl` =
    `previewAliasUrl(HOMEPAGE_PAGES_PROJECT, preview)`.
  - `pnpm ops build-homepage` / `deploy-homepage`, in the verb list, the header examples and the
    usage.
- **common:** `builtHomepageProblem` and `builtHomepageAt` (index.html's mtime) beside
  `builtHubProblem` in `builtExport.ts`. `homepageOutDir(paths)` exported from `publish/build.ts`,
  so the editor does not re-derive the path.
- **Found and fixed: `JobLane` under Strict Mode.** The launch effect gated its updates on a flag
  local to it, set by its cleanup. `next dev`'s mount → cleanup → mount set that flag, and the
  second run returned early on `startedRef`, so the job ran while the lane sat on "Starting…"
  forever. Liveness is now a ref kept by its own effect. Production mounts once and is unchanged.
  No spec had ever clicked a lane button (batch, specific sites, hub), which is how it went unseen.

**Corrections to the plan** (also in its "As shipped" note):
- The ops preview is `--json '{"preview":"<b>"}'`, not a `--preview` flag.
- No `jobKinds.ts` entries: the hub's kinds have none, and neither does any publish kind.
- `homepageOutDir` had to be exported.

**How nothing in e2e builds or deploys.** There is no fake wrangler, `homepage/out` is the
checkout's own directory (the primary's holds the live homepage's build), and the hub's buttons have
no spec to copy. So:
- **No spec clicks Deploy homepage.** None ticks Deploy after build and then clicks Build.
- **Build homepage is clicked only with the `build` and `deploy` queues both held** by
  `/api/test/stuck-job`, which is never released in the spec. The `build-homepage` job only
  queues, and so would a `build-deploy-homepage` if the click regressed into one. The spec cancels
  it from its lane. Its `start()` never runs: no log file, no child, nothing written under
  `homepage/`.
- **If that spec fails before its Cancel,** the next `resetData` cancels live jobs newest first
  (`registry.list()` sorts by `queuedAt` descending). The queued build is removed before the
  holder's slot is freed, so nothing is ever promoted.
- **The deploy-homepage refusals run with both queues held the same way** (`holdBuildAndDeployQueues`
  in `ops-api.spec`). A build or deploy that a refusal failed to stop would only queue, and the
  spec's job-list check would fail.
- **The missing-build refusal is asked only when the checkout has no `homepage/out/index.html`,** as
  `deploy-hub`'s is (`211d4666`), and it is asked as a preview.
- **Checked after every run:** the worktree has no `homepage/out`, and `homepage/public` holds only
  its tracked `_headers`. Its gitignored data was not copied, because nothing here builds the
  homepage.

| sha | what |
|---|---|
| `b047b1be` | `common:` `builtHomepageProblem` + `builtHomepageAt` (`builtExport.ts`), `homepageOutDir` (`publish/build.ts`); +3 unit tests |
| `7ba41164` | `sites:` `homepageDeployActions.ts`, `HomepageBuildButtons.tsx`, the Homepage section; the Hub paragraph loses its homepage sentence |
| `54021099` | `ops:` `/api/ops/build-homepage`, `/api/ops/deploy-homepage`; `archilyzer-ops.mjs` verbs + usage (+1 test) |
| `ba4ff0bb` | `e2e:` `ops-api.spec` +1 (the refusals), `sites-homepage.spec` (3) |
| `d52d017d` | `sites:` `JobLane` survives Strict Mode |
| `d9218cb7` | `sites:` the group stamps `data-hydrated`; the specs wait for it |
| `40b6a0d7` | `changelog:` `[Unreleased]` above `[0.9.4]` in `editor/CHANGELOG.md` |
| `ff8b9382` | `plans:` this record; the plan's "As shipped" note |
| `72175134` | `e2e:` review fix — the homepage refusal test, the Build homepage test and the hub's refusal test hold both the `build` and the `deploy` queue |
| `275c0fa6` | `common:` review fix — `deployHomepage` ships `homepageOutDir(paths)` (no behaviour change) |
| _this_ | `plans:` the review fixes in this record and the plan's note |

**Gates** (logs `o4-*.log`):
- **tsc** clean before every code commit (the last run on `d9218cb7`'s tree).
- **common 2,041/2,041** (2,038 + 3), editor unit **85/85**, `test:scripts` **175 + 1 skipped**
  (174 + 1, +1), mcp **269/269**.
- **Editor build** ok (59 s); `/api/ops/build-homepage` and `/api/ops/deploy-homepage` are in the
  route list.
- **e2e:**
  - Run 1 on `ba4ff0bb` (`ops-api`, `sites-homepage`, `sites-crud`, `site-publish-preview`,
    `deploy-page`, `build`, `settings`): **63 passed, 1 failed** (2.8 min). The failure was
    `sites-homepage`'s Build homepage test: the lane stayed on "Starting…", which is the `JobLane`
    bug above.
  - `sites-homepage` ×3 with the old `JobLane`: **6 passed, 3 failed**.
  - The same ×3 on `d9218cb7`: **9 passed** (27 s).
  - The final list on `d9218cb7` (the same seven specs): **64 passed** (1.8 min).
  - After the review fixes, on `275c0fa6`: `ops-api` + `sites-homepage` **26 passed** (40.5 s).
    tsc was clean, common 2,041/2,041 and `build.test.ts` 10/10. The worktree still has no
    `homepage/out`.
  - No spec here greps `deploy-hub|build-hub|HubBuild` except `ops-api`, which is in the list.
- **Numbers tool:** none.

**They bite:**
- **Unit, against `2162db92`'s source:**
  - `builtExport.test.ts` and `build.test.ts` fail to load (no `builtHomepageAt` /
    `homepageOutDir` export).
  - A mutation, `builtHomepageProblem` checking the directory instead of `index.html`, fails 1 of 8.
  - `archilyzer-ops.test.mjs` against the old script: 1 of 33 fails, the new test.
- **e2e, against `2162db92`'s `page.tsx`, `builtExport.ts` and `build.ts`,** with the new action,
  component and routes moved out: **4 of 4 new tests fail.** `ops-api` hits a 404 page ("Unexpected
  token '<'"), and `sites-homepage` finds no Homepage group. The tree was restored by a trap
  afterwards.
- **The `JobLane` fix:** the Build homepage test fails 3 of 3 with the old lane and passes 3 of 3
  with the fix.

**Review fixes** (review: SHIP AFTER FIXES, `o4-review.md`):
- **Should-fix 1, one queue held where a regression could reach the other.** The deploy-homepage
  refusal test held only `deploy`. A regressed "preview needs deploy" guard would have run a real
  `build-homepage` there: in the primary checkout, compose writes fixture numbers into
  `homepage/public`, then `next build` runs. The Build homepage test held only `build`, so a click
  turned into build-and-deploy would have reached `deploy`. Both tests now hold both queues. So does
  the hub's `deploy-hub` / `build-hub` refusal test (the review's low 4). That test **predates this
  slice** (release 7) and held nothing. In `ops-api.spec` the holds sit in one helper,
  `holdBuildAndDeployQueues`, and `before` is taken after them.
- **Low 2:** `deployHomepage` now takes its directory from `homepageOutDir(paths)`. This is a pure
  refactor, and what it ships is exactly the directory the editor judged "built".
- **Low 3** (the "built <when>" line does not refresh after an in-page build) is left as recorded
  below.

**Found and left**
- **A job cancelled while still queued keeps `"status":"queued"` in its `.meta.json`.** The
  `onCancel` path never rewrites the sidecar. The registry says cancelled, and the boot pass settles
  the sidecar. This is pre-existing and was not touched.
- **The "built <when>" line is read when `/sites` renders,** so a lane that finishes a build does
  not refresh it. The Hub's lanes do not refresh the page either.
- **`/jobs` shows the three kinds by their raw names,** as it does the hub's.
- **Nothing has been built or deployed through the new jobs:** no build and no deploy tonight, by
  rule. The proof is the rollout below.

**Rollout (owed):** the section and the routes exist only on an editor built from this code, so it
waits on the :3001 restart. After it:
1. **Build homepage** with Deploy after build unticked, or `pnpm ops build-homepage --wait`.
2. **Deploy homepage**, or `pnpm ops deploy-homepage --wait`. The job's log ends with
   `[deployed] https://<hash>.archilyzer.pages.dev`.

### Slice O3, as shipped — runner lows (2026-09-28)

Branch `r11/runner-lows` off `main` `2162db92`, worktree `/home/user/Projects/r11-runner-lows`, one
Opus implementer, beside O4 and O6. Four lows left by release 10: one from L2 ("New low"), one from
slice N's review (L2) and its knock-ons, the `cookies-mode.spec:241` intermittent N's full suite
found, and slice P's review lows L3 + L4. No settings, site or channel key; nothing on disk moves.
`CutReleaseResult.written` and an always-set `CutReleasesOutcome.untouched` are additive.

**1 — a failed confirm probe no longer clears "Missing?"** (`common/lib/availability-server.ts`).
- `resolveMaybeMissingState` decides the published state of a video that fell out of its
  channel's listing. A probe made after the scan that came back `public` clears the flag; so did
  one that came back `error`, through `stateFromAvailability`'s `error` → `available` fold. An
  `error` probe (a 403, a network failure, the bot check, a blocked run's one rate-limited probe)
  never saw the video, so it is no evidence it is there. It now leaves the video `maybe_missing`,
  like one never probed. `needs_auth` after the scan still confirms: an age gate is the video
  answering.
- **Display only, and the clean gate is untouched — proof.** `grep -rn resolveMaybeMissingState`
  over the whole repo (not `node_modules` or `.next`) finds one caller, `buildIndex.ts:1180` (the maybe-missing overlay →
  `stateByIndexKey` → a site's summaries pages and the `videoState` sub-DB the status chart
  reads), plus `videoState.test.ts`. The diff to `availability-server.ts` is the one line and its
  comment; `resolveEffectiveAvailability`, which `verifyBeforeClean` and the MtimeRecord read, is
  not in it.
- **The export check** is `common/controller/maybeMissingBuild.test.ts` (new), which runs the REAL
  `buildIndex` over a temp corpus: one video per outcome of the overlay, and the `state` each gets
  on the site's `summaries/page-0000.json` — the field the export's badge and Availability filter
  read. `export/e2e/availability-state.spec.ts` was NOT extended: it fulfils the summaries with
  mocked `state`s, so a new case there could not see the fix; it was re-run (9/9) as the contract
  check that `state: "maybe_missing"` still draws "Missing?". The shared transcript pages carry no
  `state` (found while writing the test).
- **The real count, read-only** (`o3-flip-count.ts` in the job scratch dir, `o3-flip-count.log`: reads
  `maybe-missing.json`, `availability.json`, `download-outcome.json`, `metadata.info.json`'s
  existence and `sites/*/site.json` through the build's own loaders; opens no LMDB, writes nothing):
  1,827 maybe-missing ids in 31 channels; **5 videos across 2 channels move from available to
  maybe-missing at the next index build** — `rekietalaw-rumble/v7e07us` and
  `the-quartering-rumble/v4vriou v4x5o1l v4yqask v501kfc`. Per site: **jeralyzer 4** ("Missing?"
  212 → 216), **rekietalyzer 1** (0 → 1), anilyzer, bonnellyzer, hasanalyzer and jasolyzer 0. All
  five are Rumble probes that got `HTTP Error 410: Gone` on 2026-09-25 and were stored as `error`,
  hours before `6d5cdbc3` taught the classifier that 410 is `deleted`; they are really deleted, and
  "Missing?" is closer than "available". A "Full-check unexpected" on those two channels would
  settle them as Deleted (the operator's call; nothing was run). *Done 2026-09-28 13:32Z, on the
  operator's word: all five read deleted — "Operator actions (2026-09-28 morning)", below.*

**2 — a failed forced download keeps the subtitle pass's status** (`common/ytdlp/downloadOneManaged.ts`).
- The attempt-3 `else` set `status = "failed"` and `lastSucceeded = false` for a `keepTranscript`
  pass too, so a "Persist source video", `fetch_clip` `full: true` or Persist kept now whose MEDIA
  failed put "Download failed" on a video whose transcript is fine. A `keepTranscript` failure now
  keeps the status (the subtitle pass's `ok` / `ok-with-cookies`) and `lastSucceeded`, so the
  archive line the subtitle pass printed is appended as on the success path; the failed n: 3
  attempt is recorded with its error (no `failureClass`: the download did not fail). One log line:
  `forceMedia: the source download failed (yt-dlp exit N); the transcript on disk is untouched and
  the download stays ok. Left for a retry to resume: source-media.f137.mp4.part (<size>).`
- **Knock-on 1, fixed: the job reports it.** `sourceFetchFailure(record)` (exported) says whether a
  download asked for the source got it: the status for an outright failure, the last attempt for a
  failed forced pass. `archiveSourceVideo` (`videoActions.ts`, both "Persist source video" and
  `fetchFullSourceAction`) throws `The source video was not downloaded: <yt-dlp's line>` after its
  revalidate, so the job ends `failed` and the poll's `error` tail carries the line; the MCP renders
  "Editor job … failed" with it instead of "finished but named no file". A download that failed
  outright ends the job `failed` too (before: `done`).
- **Knock-on 2, left on purpose: the `.part`.** yt-dlp resumes a partial container on a retry, and
  deleting one that is several GB makes a retry after a network blip start over — more requests
  against the source, which the pacing rules want fewer of. Nothing else surfaces a
  `source-media.*.part` (the Partial downloads bucket matches `audio.<ext>.part` only), so the log
  line names it and its size instead.

**3 — the `cookies-mode.spec:241` intermittent** (`DownloadStage.tsx`, `RetryBucketControl.tsx`).
- The mechanism is wider than the end-of-run refresh: `recordTaskDone` → `requestSnapshotOnFinish`
  regenerates the snapshot after EACH video a batch finishes, the pulse moves and `AutoRefresh`
  refreshes the page while the run still streams. The refreshed `NeedsCookiesList` got an empty
  bucket and returned null, and so did the `RetryBucketControl` in it — two unmounts, either
  enough to lose the log.
- The FACTS shape, in both: `ranHere` set inside the trigger (`RetryBucketControl` also calls a new
  optional `onRun` so its card knows), null only while `ids.length === 0 && !ranHere`, and
  `disabled={ids.length === 0}` so the surviving panel is not a second Run button. Applied to all
  three bucket cards on the Download stage (`NoTranscriptList`, `PartialDownloadsList`,
  `NeedsCookiesList`, same hazard) and to `RetryBucketControl` itself. Beyond the Download stage
  it reaches one more control: the Transcribe stage's **Fetch audio** (its section stays mounted
  while `autoSubsCount > 0`, and a fetch moves videos from "Needs audio" to "Ready to transcribe").
  It does NOT reach Diagnostics: both of its grids drop an emptied bucket's whole card
  (`DiagnosticsStage.tsx:156` `populated`, `:694` `listed`), control and log with it (corrected in
  review; see Review fixes). A reload drops an empty card as before (the reload check at the end of
  the same test still passes); labels and test ids unchanged.
- **Made deterministic.** The spec now waits for the refreshed, EMPTY card (`needs cookies empty`,
  which renders only inside a card that survived the refresh) and asserts the log's last line and a
  disabled `Download with cookies (0)` in it. On the old code this fails every time, at that line
  (below).

**4 — cut-release review lows L3 + L4** (`common/controller/cutRelease.ts`, `api/ops/cut-release`).
- **L3:** `applyCut`'s commit failure returns `{ok: false, workspace, error, written: true}` — the
  file on disk has its new heading. The route revalidates whenever anything was written.
- **L4:** `cutReleases` sets `untouched` on EVERY outcome (true = no changelog written, every refusal
  included; false once one was, a `written` failure included); the type keeps it optional only so
  the CLI's hand-built display tests compile, and absent reads as false. `describeCutFailure`
  builds the route's 400 `error`: the failure (prefixed `<workspace>: ` for `all`), then `Before
  it, editor was already cut (## [0.9.5] - 2026-09-28, committed 1a2b3c4d).` Every 400 from the
  writer carries `untouched`. An `all` whose FIRST write fails wrote nothing and is `untouched: true`, so the CLI
  prints "not cut — all cuts both or neither, and nothing was written" for the export — true.
  The input refusals before the writer (a bad workspace, version, date or key) are the ops door's
  400s and carry no `untouched`, as before.
- The CLI (`common/bin/release.ts`) is unchanged: its per-line output already named the earlier cut
  and says "failed — Cut release X, but the commit failed" for L3.
- **The `/sites` form** (`editor/app/sites/lib/cutReleaseAction.ts`) revalidates on `written: true`
  too. It is under `editor/app/sites/**`, which slice O4 owned tonight, so it landed after O4's
  merge (Review fixes).

| sha | what |
|---|---|
| `877403db` | 1: `resolveMaybeMissingState` — `error` after the scan stays `maybe_missing`; `videoState.test.ts` +2, `maybeMissingBuild.test.ts` (new, 1) |
| `8c72265c` | 2: the `keepTranscript` failure keeps the status; `sourceFetchFailure`; `archiveSourceVideo` fails the job; `forceMedia.test.ts` +2; the fake's `.fake-ytdlp-media-fail` knob; `fetch-window.spec.ts` +1, `persist-youtube-handling.spec.ts` +1 |
| `86449b88` | 3: `ranHere` / `onRun` / disabled in `RetryBucketControl` and the three Download-stage bucket cards; `cookies-mode.spec.ts:241` made deterministic |
| `edec55ca` | 4: `written`, always-set `untouched`, `describeCutFailure`, the route; `cutRelease.test.ts` +4 (1 changed); `ops-cut-release.spec.ts` pins `untouched` |
| _this_ | `plans:` this record, FACTS (three amendments, one new section), the `[Unreleased]` bullets |

**Gates**, from the worktree root; logs `o3-*.log` in `$T`.
- **tsc** (`pnpm -r --no-bail --workspace-concurrency=1 exec tsc --noEmit`) clean before each code
  commit: `o3-tsc1` (item 1), `o3-tsc3` (items 2 + 3, item 4 stashed), `o3-tsc4` (item 4).
- **common 2,047/2,047** (release 10's 2,038 + 9: videoState +2, maybeMissingBuild +1, forceMedia
  +2, cutRelease +4); **editor unit 85/85**; **`test:scripts` 174 + 1 skip of 175**; **mcp
  269/269** (`o3-units1.log`, on `edec55ca`).
- **Editor build** `pnpm --filter editor exec next build` ok, 55 s (`o3-build1.log`; the route table
  lists `ƒ /api/ops/cut-release`). **Export build not run**: nothing under `export/` changed but
  its CHANGELOG.
- **e2e** (queued, detached, `export/public` linked per path from the primary with `sw.js` a plain
  copy, no dangling links; the lock was free each time):

  | run | specs | passed | failed | time |
  |---|---|---|---|---|
  | A | `cookies-mode maybe-missing persist-youtube-handling fetch-window saved-videos cut-release ops-cut-release retry-bucket partial-downloads-bucket auto-subs-replace bulk-actions no-subs-fallback storage-locations` (`o3-e2e-specs.txt`: the prompt's seven, the four that drive a retry-bucket control, and the two that drive the source-media branch) | **61** | **0** | 3.9 min |
  | B | `cookies-mode.spec.ts --repeat-each=3` | **18** | **0** | 1.8 min |
  | C | EXPORT `availability-state.spec.ts` | **9** | **0** | 30 s |

  `archives-off.spec.ts` draws no state badge, so it was not added. The primary's
  `export/public/sw.js` was not written (md5 `355d0d21…`, mtime 00:51:32, before and after).
- **Numbers tool:** `o3-flip-count.ts` (item 1), above.

**They bite.**
- Unit, item 1 (`o3-bite1.log`): with the `error` line reverted, `maybeMissingBuild.test.ts` fails
  and `videoState.test.ts`'s "error, probed AFTER the scan" fails; 15 others pass.
- Unit, items 2 + 4 (`o3-bite2.log`): with the `keepTranscript` branch removed, forceMedia's new
  behaviour test fails (the `sourceFetchFailure` table test is of a new function); with `written`
  and the always-set `untouched` reverted, 5 of 20 cutRelease tests fail (the four new and the
  changed half-way test).
- **e2e** (`o3-e2e-bite.log`): the six source files at their `2162db92` versions, the new specs and
  fake kept; `fetch-window persist-youtube-handling cookies-mode ops-cut-release`: **16 passed, 4
  failed, 2.5 min**, and the four are exactly the new and changed tests —
  `cookies-mode.spec.ts:241` at `getByLabel("needs cookies empty")` (the card is gone),
  `fetch-window.spec.ts:465` (`done`, not `failed`), `ops-cut-release.spec.ts:73`
  (`untouched` undefined), `persist-youtube-handling.spec.ts:182` (no failure line; the old run
  marked the download failed). Restored with `git checkout HEAD --`.

**Found and left.**
- ~~`persistKept` still counts a returned download as persisted~~: done in the review fixes.
- **L3/L4 have no HTTP e2e for the half-way cases.** The fixture server's changelogs are gitignored
  copies, so a commit there fails only after the dirty-tree guard has run git in the WORKTREE, and a
  failed write needs a read-only directory the server's path cannot be pointed at. The controller's
  tests drive both in temp repos (a refusing pre-commit hook; a `0555` directory); the spec pins
  `untouched: true` on a refusal.
- **A Diagnostics card after its run.** A Diagnostics retry that empties its bucket still loses
  its card and its log: `DiagnosticsStage.tsx:156` / `:694` filter emptied buckets out before the
  control renders. The follow-up is to lift a ran-bucket set into both sections and keep those
  cards in `populated` / `listed`.
- **The five 410 videos** are published as available today and will read "Missing?" after the next
  build; a Full-check unexpected would make them Deleted. *Ruled and done 2026-09-28 13:32Z: the
  full check read all five deleted, so they publish as Deleted, not "Missing?".*

**Review fixes** (review SHIP AFTER FIXES, `o3-review.md` in the job scratch dir: one should-fix, wording only; three
lows; one nit; the three questions ruled — keep `archiveSourceVideo`'s failure broad, staying
mounted is fine as a rule, keep `untouched` optional tonight).
- **Merge.** `export/.next/dev` removed first (run C's export dev server had left stale types there,
  so `tsc` failed in `export/` — low 3, environment only), then `git merge main` at `baaa4b47` (O4
  merged). Conflicts only in `editor/CHANGELOG.md` (one `[Unreleased]`: O4's two bullets, then
  O3's three) and this file's Record (O4's section, then O3's).
- **The deferred `/sites` form change.** `cutReleaseAction` revalidates when the result is
  `written: true`, then returns the error as before. The reviewer read it as correct and complete;
  no e2e can make the fixture server's commit fail after the write, so tsc and the controller's
  tests cover it, and `cut-release.spec.ts` re-ran green.
- **should-fix — the Diagnostics claim was false.** The record and the changelog said the Diagnostics
  buckets' retry controls keep their log; both Diagnostics grids drop an emptied bucket's card, so
  they do not. Item 3 above, the editor bullet ("The Transcribe stage's "Fetch audio" button does the
  same. (A Diagnostics card still disappears…)"), FACTS and found-and-left now say exactly what is
  covered: the Download stage's three cards and the Transcribe stage's Fetch audio.
- **low 1 — `sourceFetchFailure`'s order.** A no-subs fallback that fetched and persisted the source
  and whose inline whisper then failed ends the download `failed`; reading the status first called
  that source "not downloaded". When the last attempt is the media pass, its exit code alone
  answers now; otherwise the status. Latent here (`inlineTranscribeOnFallback` is off on the
  primary).
- **low 2 — `persistKept`.** It counted every returned download as `persisted`; it now reads
  `sourceFetchFailure` and counts a failed forced pass as `failed`, with the reason in its log.
- **nit.** The inert `key="retry"` on the Download stage's three retry controls is gone.

| sha | what |
|---|---|
| `0c770285` | merge `main` (`baaa4b47`, O4): the changelog and Record conflicts |
| `f62d00f1` | the Cut release form revalidates on `written: true` |
| `e9947421` | low 1: `sourceFetchFailure` reads a media-pass last attempt first; `forceMedia.test.ts`'s table +1 row |
| `315c76e1` | low 2: `persistKept` counts a failed forced pass as failed; `persistKeptForceMedia.test.ts` +1 (setup made one helper with a process-wide settings file) |
| `5c9987d2` | nit: the inert keys dropped |
| _this_ | `plans:` these fixes, the corrected wording (record, changelog, FACTS) |

**Gates on `5c9987d2`:**
- tsc clean after the merge (`o3-tsc5.log`) and on the fixes (`o3-tsc6.log`); every fix commit is a
  disjoint set of files from that tree.
- common **2,051/2,051** (2,041 on `main` after O4, + O3's 10), editor unit **85/85**,
  `test:scripts` **175 + 1 skip of 176**, mcp **269/269** (`o3-round2.log`).
- e2e `cut-release ops-cut-release persist-youtube-handling fetch-window saved-videos cookies-mode`
  (`o3-e2e-specs2.txt`, `o3-e2e2-full.log`): **28 passed, 0 failed, 1.3 min**, no queue wait.
- **They bite** (`o3-bite3.log`): with the old order in `sourceFetchFailure`, the table test fails on
  the new row; with `persistKept` counting every return, the new persistKept test fails; the other
  8 in the two files pass.

### Slice O6, as shipped — one-core Phase 4 slice 3 (2026-09-28) — checkpoint A

Branch `r11/phase-4-s3` off `main` `2162db92` (no later `main` to merge before the first commit),
worktree `/home/user/Projects/r11-phase-4-s3`, port block #6, one Opus implementer. The spec is
[`one-core.md`](one-core.md) "Phase 4", items 2 (the rest) and 3. Checkpoint A is everything but
the `E2E_` prefix cleanup, which is checkpoint B, after O1–O5 land.

**The CLI's last subcommands.**
- **`archilyzer doctor [--json]`** (`common/bin/doctor.ts`). One read-only report over what was
  spread across `paths.ts`, umtool's doctor and `scripts/worktree.mjs`:
  - workspace: node against next's `>=20.9.0`, the checkout, `node_modules`, the path overrides set;
  - corpus: channel count, each channel's media through `inspectChannelMedia`, the LMDB index by
    `stat` only;
  - settings: `settings.json` present, a JSON object, loads (`settingsFromFile`, new in
    `settings.ts`: getSettings' body for a named file);
  - tools: every binary `paths.ts` names, plus each enabled local worker's engine, `parakeet-cli`
    and model (looked up on PATH, not run);
  - umtool's report-pipeline table (read from `umtool/lib/tools.mjs` by a runtime import of the
    file; common does not depend on umtool);
  - the port block (asked of `scripts/worktree.mjs ports`), each port free or in use by a TCP
    connect.
  - A FAIL exits 1. It is something the machine is configured to do and cannot: a settings file
    that is not a JSON object (every process silently reads defaults), an enabled worker's engine or
    model missing BESIDE a corpus, yt-dlp/ffmpeg/ffprobe missing beside a corpus, a binary an env
    override names explicitly, node too old, no `node_modules`. Everything else warns or notes. A
    clone with no corpus is not broken, and an engine missing there is a warning.
  - Strictly read-only: no LMDB open, no mkdir, no settings write, no bind. The one process-state
    change is a `chdir` around umtool's table (it resolves `facecrop.py` from the cwd), restored
    at once.
- **The probe exists once.** `common/lib/toolProbe.mjs` is umtool's `probeOne` lifted out (plain
  ESM, exported); `umtool/lib/tools.mjs` keeps its table and calls it. `probeTools()` output was
  byte-identical before and after (`o6-umtool-probe-{before,after}.json`, `cmp`).
- **`archilyzer run <operation> <channel> [ids…] [--lane local|remote]`**
  (`common/bin/run-operation.ts`) calls `runOperationChannelJob`, the body the /channels
  buttons, the stage cards and the lane runners call. So a run is a real `backfill-channel` /
  `digest-channel-*` job: its record and log under `.jobs/`, the same summary line, the channel
  snapshot flushed at the end, and `runManagedFunction`'s media guard (a refusal before any record
  exists).
  - **Runs:** diarization, attribution-diarized, attribution-text, digest (the four registry
    operations).
  - **Refused with a sentence read off the descriptor:** sync, metadata-scan, download (the
    per-platform download queue paces every request to one source inside the editor), and
    transcription (the editor's worker pool).
  - **Refused up front:** an unknown operation (with both lists), an unknown channel, an
    operation switched off in settings, a paused lane (the batch would idle-wait for a resume
    only the editor can give), and `--lane` off digest. Ids with no data dir are named.
  - Ctrl-C cancels the job. Exit 0 done, 1 failed or refused, 2 usage, 130 cancelled.
  - Different from the editor's run, and said in the file's header: it does not see the editor's
    transcription activity, so the backfill lane's yield-to-transcription does not apply.
  - To carry ids, `runDigestChannelJob` gains `ids` (as the backfill job has; into
    `spec.params`), `runOperationChannelJob` passes `ids` to both runners, and the editor's
    digest replay forwards them through `digestChannelAction`, so a replayed scoped run cannot
    widen to the channel.
- **`archilyzer mcp [args…]`** (`common/bin/mcp.ts`) starts the MCP server as `pnpm --filter
  yt-dlp-transcript-mcp exec tsx src/index.ts` does: mcp's tsx, cwd `mcp/`, env passed through. It
  is a child process, not an import. Nothing is printed on stdout.
- **`pnpm archilyzer <command>`** is a new root script for the long form. pnpm prints its `$ …`
  line on stderr, so `-- pnpm -C "$PWD" archilyzer mcp` is a clean MCP registration (initialize
  handshake checked through it).
- **Every bin is a subcommand.** `_cli.ts` gains PASSTHROUGH rows. They are matched on the leading
  words only, and everything after the path is handed on verbatim.
  - In-process: `build stats|templates|archives`, `docs env|files`, and `brand media` (with its
    argv).
  - As children with their own flags (`_spawnBin.ts`): `duplicates` (with the 8 GB heap its script
    had), `posts fetch|check`, `diarize backfill`, `digest plan|validate`, `reconcile video-dirs`,
    `verify transcripts`, `transcribe` (`transform.ts`; deleted with its row in the review
    round, `9424d357`) and `migrate channel-priority`.
  - A test fails when a file in `common/bin/` has no row.
- **package.json.**
  - Kept: the scripts the publish pipeline runs by name: export's `build:index`, `build:stats`,
    `build:templates`, `build:archives`, `compose:site` and `compose:hub` (`build.ts`'s steps and
    docker Phase A), and homepage's `build:index` and `compose`. They keep their names and heaps
    and now call `archilyzer <row>`. Each was checked with `pnpm run <script> --help` (it prints
    its row), and `build:data` + `compose:site` + `compose:hub` were smoke-run on a scratch corpus
    (all exit 0).
  - Removed: export's `detect:duplicates` (no referrer; it is now `archilyzer duplicates`).
  - Kept, with the reason: root `build:index` / `sync:tick`. They are one-line CLI aliases, and
    `sync:tick` is the documented cron line (SCHEDULED_SYNC.md, the editor's sync console copy,
    SETTINGS.md), so removing it would silently break an operator's crontab.
  - `docker/build-site.sh` and `publish-site.sh` still parse (`sh -n`) and name `build site`,
    which exists.

**Ports exist once.** `common/lib/ports.mjs` is the table (name, base, what for), with
`OFFSET_STEP`, `portsForOffset` and `portFor`.
- `scripts/worktree.mjs` imports it, and gains the three e2e ports it never offset: `HUB_PORT`,
  `ORIGIN_B_PORT`, `HUB_A_PORT`.
- `sync tick`'s default URL and the doctor read it.
- Two places cannot import a module, and `ports.test.ts` reads them as text and fails on a
  mismatch or an undeclared port:
  - a package.json script's `${NAME:-N}` (a shell line);
  - the `--ports NAME:N` list handed to queue-lock (its syntax is shared with older checkouts).
- The playwright configs and e2e helpers still spell their fallbacks, held by the same test. B
  points them at the module, since it edits them anyway (homepage's is O2's tonight).
- Not in the table: the client default URLs (`mcp/src/fetchClip.ts`, umtool's tag route,
  `archilyzer-ops.mjs`) and the container's ports.

**Config and docs.**
- **Env vars, declared once.** `common/lib/envVars.ts` lists every variable the apps' code
  reads, by audience:
  - `paths` (exactly what getPaths reads);
  - `runtime`;
  - `port` (generated from ports.mjs);
  - `internal` (set by the pipeline);
  - `docker` (the `ARCHILYZER_*` set);
  - `test`.
- `ENVIRONMENT.md` is generated from it (`archilyzer docs env [--check]`). `envVars.test.ts`
  holds the list to the code in both directions: every `process.env.X` / `env.X` read under
  common/, editor/, export/, homepage/, mcp/src and scripts/ is declared, and every entry is
  still named somewhere outside the list (a mention, not a proven read). *(Review S1: as first
  shipped, that second test counted `envVars.ts` itself as a mention and could not fail; fixed in
  `8bea5844`, which also checks every `ARCHILYZER_*` name in docker/, the Dockerfiles and the
  compose files is declared.)* umtool's own knobs stay in umtool/docs until Phase 5.
- **PUBLISH.md absorbs DEPLOY_CLOUDFLARE.md and DEPLOY_DOCKER.md.** It covers what gets
  published, the editor / `pnpm ops` / CLI table, Pages, previews, R2, the cost-abuse defenses,
  containers and the MCP registration. Both old files are removed. Every link to them now names
  PUBLISH.md, except in plans/ and the released changelog bullets: README, SETUP, AGENTS,
  RUNNING_IN_DOCKER, r2-proxy ×3, homepage/content/README.md, and build.ts's R2 refusal plus
  three comments.
- **Stale claims corrected.**
  - README's and SETUP's hand-kept env tables are now a pointer to ENVIRONMENT.md and `doctor`.
  - SETUP said `pnpm e2e` runs on port 3001; it is 3011.
  - CONTRIBUTING's "CLI shims" named a `retry-failures.ts` that does not exist; the section is
    now "The archilyzer CLI".
  - RUNNING_IN_DOCKER named whisper.cpp as the only engine; it now names parakeet.cpp beside it.
  - **Settings → Build pipeline still called Docker "a follow-up" that "falls back to a basic
    build"**, and its option read "(follow-up)". So did `settingsSchema.ts`'s description
    (SETTINGS.md regenerated) and its BuildMode comment. *(Review S2: the first rewrite
    overstated the mode as a switch — no build reads `buildPipeline.mode`. In `366553eb` the
    Settings hints, the schema texts, /sites' toggle note, the Build all paragraph and lane
    subtitle and the per-site panel note all say the mode is a label and Build all uses
    containers whenever `docker version` answers; `deploy-page.spec.ts` in step.)*
  - "Transcode as a stage": no doc claims one any more. The remaining "transcode" rows are
    ffmpeg's audio extraction.
  - `PARALLEL_TRANSCRIBE_LIMIT` was already in no doc. The only mention is the released
    changelog bullet that records its removal.
- **The two stale hub hints were already fixed.** `SettingsForm.tsx`'s `homepageUrl` hint and
  `homepage.ts`'s comments name `archilyzer-hub`, since release 7's review fix `bc2d9fb6`.
  STATE's note is stale; nothing to do.

| sha | what |
|---|---|
| `eeeef338` | `common:` `lib/ports.mjs` (+ `ports.test.ts` 4), `worktree.mjs` and `sync-tick` read it; `lib/toolProbe.mjs`, umtool's `tools.mjs` calls it |
| `9be897c6` | `common:` `lib/envVars.ts` (+ `envVars.test.ts` 6), `bin/env-docs.ts`, `ENVIRONMENT.md`, `docs env` row |
| `5c16a75c` | `common:` `archilyzer doctor` (+ `doctor.test.ts` 8), `settingsFromFile` |
| `5da3e9e1` | `common:` the digest channel job's `ids`; the dispatcher passes ids; the editor's digest replay forwards them |
| `3bfe2ab2` | `common:` `run`, `mcp`, passthrough rows, `_spawnBin.ts`, every bin a row (+ `run-operation.test.ts` 6, `mcp.test.ts` 1, `_cli.test.ts` +3) |
| `e7de1d96` | `export, homepage:` the pipeline's scripts call the CLI; `detect:duplicates` removed |
| `a132c213` | `editor, common:` root `pnpm archilyzer`; the Docker build-mode copy (Settings, schema, SETTINGS.md); build.ts names PUBLISH.md |
| `58fd7d72` | `docs:` PUBLISH.md; the two deploy docs removed; README/SETUP/CONTRIBUTING/AGENTS/RUNNING_IN_DOCKER/r2-proxy/homepage README |
| `1a65926b` | `common:` the mcp test's exit race and the run tests' timeouts (found by the bite checks) |
| _this_ | `plans:` this record; the `[Unreleased]` bullet in `editor/CHANGELOG.md` |

**Gates**, all from the worktree root. The logs are `o6-*.log` in the job's scratch dir.
- **tsc** (`pnpm -r --no-bail --workspace-concurrency=1 exec tsc --noEmit`) was clean four times:
  91 s before `eeeef338`, 58 s before `5da3e9e1`, 66 s before `a132c213`, and 95 s on
  `1a65926b`. The three commit groups in between are prefix-closed subsets of a checked tree: no
  file in a commit imports one from a later commit. `58fd7d72` is docs only.
- **common 2,066/2,066** (2,038 + 28: ports 4, envVars 6, doctor 8, run 6, mcp 1, `_cli` 3), 47 s.
- **editor unit 85/85**, 4 s.
- **`test:scripts` 174 + 1 skip**, 9 s.
- **mcp 269/269**, 18 s.
- **`next build`:**
  - editor ok, 36 s;
  - umtool ok, 17 s (`tools.mjs` now imports `yt-dlp-transcript-common/lib/toolProbe.mjs`);
  - export ok, 27 s (no dangling `export/public` links).
- **e2e:**
  - **Editor** (`o6-specs.txt`: `digest.spec.ts backfill.spec.ts jobs-retry.spec.ts`, which
    also matches `availability-backfill.spec.ts`), no queue wait: **39 passed, 0 failed, 3.2
    min**.
  - **umtool** `dashboard.spec.ts` (`SONG_DIR=~/reports/quartering-uh-song/data`, through
    `wt run`): run 1 was **6 passed, 1 failed, 1.1 min**. The failure was "the projects panel
    says exactly what /browse's header says": `page.goto` aborted during the cold `next dev`
    compile (35 s). It does not touch the tool probe. The two probe tests (the tools panel, and
    `umtool doctor` exiting 1 on a bad path) passed. Rerun: **7 passed, 25.8 s**, after 19 s in
    the queue.
  - Nothing else an e2e exercises changed: the editor suite never runs the export build scripts
    to completion (`deploy-page.spec.ts:130` says so), hence the scratch smoke-run.
- **The CLI by hand, on scratch corpora only:**
  - `run diarization chan` exited 0 in 2 s, with the summary line and two job records (the run
    and the snapshot).
  - `run sync chan` exited 2 with the sentence (1 since review L6: a refusal, not a usage error).
  - `mcp --local <dir>` answered initialize, both directly and via `pnpm -C … archilyzer mcp`.
  - `doctor` on the worktree: no failures. Parakeet workers ×3 (engine, cli, model), every
    binary, umtool's table (python absent: info), block #6 with every port free.
- **Nothing ran against the primary's `transcripts/`.**

**They bite** (each mutation in a scratch copy of the tip, `o6-bite.log`):
- ports: an export dev default drifting to 3009, and an undeclared `NEW_STUB_PORT` in a
  playwright config, each fail 1.
- envVars:
  - an undeclared read in `workerToken.ts` fails 1;
  - a declared var nothing reads: as first shipped this "failed 1" only because ENVIRONMENT.md
    went stale — the mention test itself passed (review S1). After `8bea5844`, with
    ENVIRONMENT.md regenerated, the mention test fails 1;
  - an undeclared `ARCHILYZER_NEW_KNOB` in `docker/entrypoint.sh` fails 1 (review L5);
  - a hand-edited ENVIRONMENT.md fails 1;
  - a new override in `paths.ts` fails 2.
- doctor:
  - a `mkdirSync` before returning fails 3 (the tree snapshots);
  - a non-JSON settings file as a warning fails 1;
  - a corpus that does not need the media tools fails 1.
- run:
  - the dispatcher dropping `ids` fails 1 ("ids scope the run");
  - external ops not refused fails 2;
  - ids none of which is on disk, not refused, fails 1 (review L6);
  - a paused lane not refused gives pass 2, cancelled 4, exit 1. The held job leaves only
    unref'd poll timers and node cancels the rest.
- cli: `verify transcripts`' row removed fails 1 (every bin reachable); passthrough disabled
  fails 1.
- mcp: the row renamed fails 1. It hung before `1a65926b`, which the bite found.

**Found and left** (after the review round):
- **For the operator: should Build all / Build & deploy all honour `buildPipeline.mode`?** Today
  they use containers whenever `docker version` answers and the mode is a label (review S2). The
  parent ruled copy-only tonight; honouring it (basic → serial host even when docker answers) is
  a behaviour change for its own slice.
  *Ruled 2026-09-28 (morning): dropped — follow-up O6c removed the mode, the toggle and the select.*
- **`run` does not see the editor's lanes** (review L1). Beside the editor's lane on the same
  channel it does the same videos twice — wasted CPU, not damage (atomic writes). Said in the
  header and the usage line; a `.jobs/` check for a running job of the same kind and slug is not
  implemented.
- **Until :3001 restarts, its digest replay predates `ids`** (review L2): Retry on an ids-scoped
  `archilyzer run digest` job from the old editor widens to the whole channel (money, on the
  metered lane). Morning runbook: restart before retrying a CLI digest job.
- **The doctor's default engine binary comes from `app.defaultBin()`** (the global `getPaths()`),
  not the injected paths (review L7). The same in production; wrong only under injected test
  paths. Left: a fix would re-derive each app's default beside the registry.
- **No spec replays a digest job**, so the replay forwarding `ids` is type-checked only.
- `mcp/README.md`'s and AGENTS.md's `claude mcp add` examples were left alone (O1 owns the first;
  the prompt said leave both). The new form is in README and PUBLISH.md.
- `homepage/content/docs/*` are hand-derived copies by design. Only the drift table in
  `homepage/content/README.md` was updated.
- Resolved in the review round: AGENTS.md's, the entrypoint comment's and RUNNING_IN_DOCKER's
  "no workers → zero workers" claim (Q5); the two released changelog links (Q1, retargeted,
  words unchanged); `archilyzer transcribe` (Q2, deleted); PUBLISH.md's homepage row (Q4).
- **Optional, not done:** SETUP.md absorbing SCHEDULED_SYNC.md and WORKTREES.md; PLAN.md's phase
  table becoming a pointer to STATE.md.
- **Checkpoint B** (the `E2E_` prefix cleanup, and the playwright configs importing ports.mjs) is
  next, after O1–O5 land on `main`.

**Review fixes (checkpoint A)** — the review (`o6-review.md`) was SHIP AFTER FIXES: no blocker,
two should-fixes, seven lows; the parent ruled on the questions. First `main` `c1d4790a` (O4 + O3)
was merged: conflicts only in `editor/CHANGELOG.md` (one `[Unreleased]`: O4's and O3's bullets,
then O6's) and this file (O4's and O3's records, then this one).

| sha | what |
|---|---|
| `fcdaea12` | merge `main` `c1d4790a` |
| `8bea5844` | S1: the mention test leaves `envVars.ts` out and can fail; L5: docker/'s `ARCHILYZER_*` names must be declared (+1 test) |
| `366553eb` | S2: the build-mode copy says the mode is a label (Settings, schema + SETTINGS.md, /sites toggle, Build all, per-site panel; `deploy-page.spec.ts`) |
| `ef84f535` | Q1: the two released changelog links → PUBLISH.md anchors, words unchanged |
| `9424d357` | Q2: `transform.ts` + the `transcribe` row deleted; L6: usage 2 / refusal 1, all-absent ids refused (+1 test); L1 in the header and usage |
| `bec01bf9` | Q5: the seeded-worker claim (AGENTS.md, the entrypoint comment, RUNNING_IN_DOCKER); L4: WORKTREES.md → ENVIRONMENT.md#ports, `pnpm dev:*` in ports.mjs, umtool's config comment |
| `36db91e2` | S2 / Q4 / L3 in PUBLISH.md |
| _this_ | `plans:` this record |

Gates on the merged tree, from the worktree root (`o6-gateR.log`, `o6-e2e-editorR.log`):
- **tsc clean** before `8bea5844` (on the merge: 102 s; again with S1+S2: 76 s) and before
  `9424d357` (33 s, incremental). `ef84f535`, `bec01bf9` and `36db91e2` change no TypeScript
  but `ports.mjs`' description strings.
- **common 2,081/2,081** (main's merged tests plus this round's 2), 45 s. **editor unit 85/85**.
  **`test:scripts` 175 + 1 skip** (O4's +1). **mcp 269/269**.
- **`docs env --check`, `settings example --check`, `docs files --check`: all exit 0.**
- `docker/entrypoint.sh` still parses (`sh -n`).
- **Editor e2e** `deploy-page.spec.ts digest.spec.ts backfill.spec.ts jobs-retry.spec.ts`
  (`o6-specsR.txt`; `backfill.spec.ts` also matches `availability-backfill.spec.ts`), no queue wait: **43 passed, 0 failed, 2.9 min** (39 before + deploy-page.spec's 4, the build-mode sentence among them).
- **They bite** (`o6-bite.log`, "review round"): a declared `ZZ_NOBODY_READS_ME` with
  ENVIRONMENT.md regenerated fails exactly the mention test (1); an undeclared
  `ARCHILYZER_NEW_KNOB` in the entrypoint fails 1; all-absent ids not refused fails 1.

### Slice O1, as shipped — hub lows and the DRAFT copy (2026-09-28)

Release 10's hub lows (`release-10.md`, "Slice L1, as shipped", both "Found and left" lists) and
STATE's x.com icon low, with the three lines that need words shipped as DRAFT constants for a
morning ruling. Branch `r11/hub-lows` off `main` `2162db92`, merged up to `baaa4b47` (O4) before
the first commit; worktree `/home/user/Projects/r11-hub-lows` (port block #4). One Opus
implementer. Scratch files `o1-*` in the job's `tmp/overnight`.

**What shipped.**
1. **A "built-ins loaded" flag** (`common/components/siteRegistry.ts`). `builtinsLoaded` turns true
   once `/hub-sites.json` has been answered — a list, `[]`, a 404, a 500, a network error, bad JSON
   or a non-list. It is set in the same update that adds the built-ins (one `emit`), so no reader
   sees "loaded" over a list that lacks them. `useRegistry()` returns it, and `getBuiltinsLoaded()`
   reads it outside React. `loadBuiltins` is exported, and so are the store's `getRegisteredSites` /
   `subscribeRegistry`. The one-shot guard is now its own `builtinsRequested`: before, a flag named
   `builtinsLoaded` was set at the START of the fetch. The file is still never retried.
2. **`/ask` counts as ready only once the hub's list is in.** `useHubSites()` returns
   `listed = builtinsLoaded && summary settled`, and `useFederatedSites()` passes it through.
   `MultiSiteDataProvider` takes a `listed` prop (default `true`), and
   `allSettled = listed && …`. `federation` carries `listed`. `AskHub` passes it; the front page
   does not, so it is unchanged. The archives a browser added are read from storage at once, and
   `/hub-sites.json`'s arrive a moment later. Before this, a question sent in between grounded in
   the added archives alone. Their fetches still start at once; only readiness waits.
3. **Three DRAFT copy lines** (`export/app/ask/hubScopeCopy.ts`), each marked
   `// DRAFT (release 11, 2026-09-28) — awaiting the operator's ruling`:
   - **`NO_ARCHIVES_ON_HUB`** (`:16`). On `/ask`, once the list is in and it is empty (a hub whose
     `hub-sites.json` is `[]` or failed, with none added here), the composer shows it in
     `data-testid="ask-blocked"` (`role="status"`), the box and Ask disabled. It replaces
     "Loading transcripts…" forever. Its [bracketed] words link to `/`, where the add form is.
   - **`LIVE_CHAT_MISSING`** (`:24`). The note on a scope chip (`data-testid="hub-scope-live-chat"`)
     for a READY archive whose subs manifest settled in error. Beside it is a Retry, accessible name
     `Retry live chat from <title>`: `federation.retryLiveChat(origin)` refetches
     `["subs-manifest", origin]` exactly, and nothing else. The Retry is disabled while it runs.
   - **`ASK_SCOPE_LINE`** (`:33`). A function of `(inScope, total)` so the plural and the words are
     one editable constant. `AskScope` renders it (`data-testid="ask-scope"`) between `/ask`'s
     header and the chat, once the list is in, whenever at least one archive is in scope. Returning
     `null` hides it: e.g. `inScope === total ? null : …` shows it only when some archives are off.
     Its [bracketed] words link to `/`.
   `NO_ARCHIVES_IN_SCOPE` (L1's draft, still unruled) also waits for the list now, so it no longer
   flashes while the built-ins arrive. `LinkedCopy` (`export/app/ask/LinkedCopy.tsx`) is the one
   renderer of a copy line with its link. It replaces AskChat's inline split.
4. **The archive stays ready through a live-chat Retry.** TanStack puts an errored query that has
   no data back to `pending` while it refetches (`fetchState`, query-core 5.100.5). So
   `isError && !isFetching`, L1's rule, would have taken the archive and its videos out of the
   search for the length of the Retry. The subs rule now keys on `errorUpdateCount > 0` with no
   data: the count moves only once the query's own retry is spent, and it survives a refetch.
   `FederatedSiteState.liveChatMissing = {retrying, error?}` rides in `statusKey`.
5. **`normalizeSocialSvg` themes every fill colour** (`common/lib/settingsSchema.ts`). *(Narrowed by
   review fix 1 below: only a single-colour icon is themed; a multi-colour one keeps its colours.)*
   - **What changes.** Every `fill` attribute, and every `fill:` in a `style`, becomes
     `currentColor`: the root's (a root colour too, not only an absent one) and every child tag's.
     The exceptions are `none`, `transparent`, `currentColor`, `inherit` and `url(…)` paint (with or
     without a fallback).
   - **What is kept.** The tags inside a `<mask>` (white and black there are coverage, not colour),
     `fill-rule` / `fill-opacity`, strokes and gradient stops.
   - **The operator's icons.** x.com: the root's `fill="none"` stays, and the path's `white` becomes
     `currentColor`. Kiwi Farms: the gradient drop and its stops are unchanged, and the `#414042`
     dot follows the footer's colour.
   - The function is idempotent.
6. **`mcp/README.md`.** The `claude mcp add` and `mcp.json` examples carry
   `ARCHILYZER_EDITOR_URL=http://localhost:3001` and `WORKER_TOKEN=…`, marked optional for
   `fetch_clip` in AGENTS.md's words (the URL's default and the no-editor answer added). mcp has no
   changelog.

| sha | what |
|---|---|
| `0a2ba7b9` | `common:` siteRegistry `builtinsLoaded` (+ `getBuiltinsLoaded`, exported `loadBuiltins`), set in the same update as the built-ins; +8 unit tests |
| `615563d1` | `common: normalizeSocialSvg` themes every fill colour, children's too; `none` / `url()` / mask fills kept; +8 unit tests |
| `2f9b5ab9` | `hub:` `listed` through `useHubSites` → `MultiSiteDataProvider` → `federation`; `liveChatMissing` + `retryLiveChat` (the `errorUpdateCount` rule); the three DRAFT constants; `AskScope`, `LinkedCopy`; the chip note; e2e `ask.spec` (+3), `federated-search.spec` (+2, and the scope line in the chips test) |
| `2ef9e745` | `mcp:` README — the two `fetch_clip` env lines in both examples |
| `db555285` | `export: [Unreleased]` above `[0.9.4]` (five bullets) |
| _this_ | `plans:` this record |

**Gates** (logs `o1-*.log`):
- **tsc:** clean (`o1-tsc-2.log`, 34 s, on the committed tree). `0a2ba7b9` and `615563d1` are
  additive subsets of it, with no type dependency on the rest.
- **Unit and script tests** (`o1-units-1.log`):
  - common **2,057/2,057** (2,041 + 16);
  - editor unit **85/85**;
  - `test:scripts` **175 + 1 skipped**;
  - mcp **269/269**.
- **Builds** (`o1-run-1.log`), with `export/public` seeded per path (17 links, none dangling):
  - export site ok (24 s), `data-accent="signal"`;
  - export hub ok (24 s), `dark data-base="dark"`, `out/ask/index.html` present.
  - Editor and homepage builds were not run: neither app changed. The editor's two save paths call
    `normalizeSocialSvg`, and its output for their e2e inputs is byte-identical (unit test 4).
- **e2e** on `db555285` (`o1-run-1.log`; no wait in the queue):
  - `e2e:hub` in full: **31 passed** (26 + 5 new), 1.3 min;
  - export `site-branding` + `ask-chat` + `ask-workspace`: **36 passed**, 1.9 min. The footer's
    social row is `site-branding`'s. No export spec reads the icons' colour, and the fixture's icon
    is already `currentColor`.
  - `e2e:2origin` (`TWO_ORIGIN_REBUILD=1`, the links in place, no swap): **3 passed**, 36.7 s.
- **The primary's `export/public`:** all **380 files**' path, size, mtime and md5 were identical
  before and after the three runs (`o1-primary-before-1.txt` vs `-after-1.txt`, `diff` empty).
  After 2origin the worktree held its own `hub-sites.json`, `sw.js`, `robots.txt`, `_headers`,
  `corpus.json` and `llms.txt`. The seed relinked them.
- **Screens** (`o1-shots/`, from a temporary spec, deleted after): the chip note and its Retry, the
  scope line under `/ask`'s header, and the zero-archive line under the composer.
- **Numbers tool:** none. No `settings.json`, `site.json` or `config.json` key changed.

**They bite:**
- **Unit, against `baaa4b47`'s source** (a scratch copy of the old `common/`, `o1-bite-units.log`):
  - `siteRegistry.test.ts` fails to load (no `getBuiltinsLoaded`).
  - `normalizeSocialSvg.test.ts` **4 of 8 fail**: x.com, Kiwi Farms, the colour spellings and the
    mask.
  - The other four pin behaviour the old code already had: unchanged icons, the bare icon's exact
    output, idempotency and the refusals. They are guards and pass on it by design.
- **Mutations of the new code:**
  - the flag set at the start of `loadBuiltins`: 7 of 8 fail;
  - the flag set only when the file listed something (the old early returns): 6 of 8;
  - the flag announced in its own update before the built-ins join: 7 of 8;
  - `none` themed too: the x.com and "unchanged" tests fail;
  - masks not skipped: the mask test fails.
- **e2e, against `baaa4b47`'s seven source files,** with the new specs and `hubScopeCopy.ts` kept
  (`o1-bite-e2e.log`, restored by a trap, tree clean after): **6 failed, 10 passed.** The six are
  every new-behaviour test:
  - the three zero-archive tests: no `ask-blocked` line;
  - the chips test: no `ask-scope` line;
  - the listed test: `Loading transcripts…` gone, because the chat was ready over the added archive
    alone;
  - the live-chat test: no note.

**Found and left**
- **The icon fix applies on save.** `normalizeSocialSvg` runs when a link is saved, not when the
  footer renders. The stored x.com icon in `settings.json` keeps `fill="white"` until the Settings
  form is saved once. Any save re-normalizes every link, with no re-paste. Then every site and the
  hub need a rebuild. A render-side pass (as `sizeSocialSvg` does for sizes) would fix stored
  icons with no save, but `Footer.tsx` and `sizeSocialSvg` are outside this slice.
  *(Corrected by the review: "save" is ANY `settings.json` write, and the homepage needs the
  rebuild too. See the review fixes' rollout note below. The review judged a render-side pass
  unneeded: every stored icon is in the global `settings.json`.)*
- **The Kiwi Farms dot changes colour.** It was a fixed `#414042`, barely visible on Dark, and now
  follows the footer's colour. The green gradient drop is unchanged.
- **Strokes are not themed.** An icon drawn with `stroke="white"` would still vanish. Neither of the
  operator's icons is stroked.
- **A failed `/hub-sites.json` reads as "no archives yet"**, the same as an empty one, and the
  registry still never retries: a reload asks again.
- **The front page does not wait for the list.** It is progressive and does not take `listed`, so
  it still settles for the instant before `hub-sites.json` arrives. This is pre-existing, and its
  chips show the loading.
- **A live-chat Retry that fails again brings the note back,** with its Retry enabled
  (`errorUpdateCount` moves, `isFetching` clears). No e2e covers that second failure. TanStack
  clears `error` during the refetch, so the Retry's title says only "Try again" while it runs. The
  button is disabled then.
- **FACTS is stale after merge** (release 10 facts, "L1 — hub lows"): "nothing says so (a new low)"
  (the subs rule) and "A hub with zero archives therefore reads 'Loading transcripts…' forever"
  are both closed here, and the subs rule's anchor now keys on `errorUpdateCount`. Not edited here
  (a shared file). *(Done in the review round, `ac9c299b`.)*

`[Unreleased]` bullets: `export/CHANGELOG.md` (five: `/ask` with no archives, its wait for the
hub's list, its scope line, the chip's missing live chat, the social icon). `editor/CHANGELOG.md`
and `homepage/CHANGELOG.md` are unchanged, because neither app changed.

**DRAFT copy for the morning ruling** (`export/app/ask/hubScopeCopy.ts`). *(Ruled 2026-09-28: all four
ship as written; the [bracket] link became `${link("…")}` in a `copy` template. See "Operator rulings
and follow-up O1c" below.)*
- `:16` `NO_ARCHIVES_ON_HUB` = "This hub has no archives yet. Add one on the [hub's front page] to ask."
- `:24` `LIVE_CHAT_MISSING` = "live chat didn't load"
- `:33` `ASK_SCOPE_LINE(n, m)` = "Searching {n} of {m} archive(s) — [change on the front page]." (shown
  whenever at least one archive is in scope, all included)
- Still owed from release 10: `:7` `NO_ARCHIVES_IN_SCOPE` = "No archives selected. Choose some on the
  [hub's front page] to ask."

**Review fixes** (review SHIP AFTER FIXES, `o1-review.md`; probes `o1-rv*`). First `git merge main`
at `cb9d02b2` (O4, O3 and O6 checkpoint A), giving `c7b42f23`. The two expected joins: one
`[Unreleased]` in `export/CHANGELOG.md` (O3's bullet, then O1's five) and the records O4, O3, O6,
then O1. No code conflicts, no dependency change (script lines only). tsc was clean on the merge
(`o1-tsc-3.log`).

1. **Should-fix: `normalizeSocialSvg` flattened every multi-colour icon, and wrote the result back**
   (`69d08bf6`).
   - **The failure.** YouTube's official mark (a `#f00` rounded rectangle and a `#fff` triangle)
     came out as a blank rounded rectangle, and a dark disc with a white glyph as a plain disc.
     `writeSettings` re-normalizes every link on EVERY `settings.json` write (`common/lib/settings.ts:247`,
     `validatedSocialLinks`), not only the Settings form. So the pasted original would be destroyed
     by the first write of any kind.
   - **The rule now.** The solid colours of the root and every child outside a `<mask>` are counted
     together (`fill` attributes and style `fill:`; `none` / `transparent` / `inherit` / `url()` never
     count). Spellings of one colour count once: `paintKey` folds `#FFF`, `#ffffff`, `white` and
     `rgb(255, 255, 255)`. With at most ONE colour, every one becomes `currentColor`, as before.
     With two or more, every colour stays as pasted: the pre-O1 behaviour, and such an icon carries
     its own contrast. The root still gains `fill="currentColor"` when it has none, and `aria-hidden`.
   - **Unchanged output:** x.com (one colour, white) and Kiwi Farms (gradient + one grey) come out
     exactly as before, and all eight earlier tests stand (the spellings test now uses one colour
     in five spellings).
   - **Idempotent:** a themed icon has no solid colour left, and an untouched one counts the same
     colours again.
2. **Edge cases** (`69d08bf6`, the same function).
   - **Animation tags are passed over.** `<animate…>`, `<animateTransform>`, `<animateMotion>` and
     `<set>` are never read or changed, because their `fill="freeze"` / `fill="remove"` is timing.
     Counted, `freeze` would also have made a one-colour icon "two colours".
   - **A self-closing `<mask … />` is matched first** (`<mask\b[^>]*\/>`). The lazy block form no
     longer swallows everything after it up to the next `</mask>`.
   - **Recorded as left:**
     - a `<pattern>`'s children are themed (a single-colour icon's pattern would flatten; a
       two-colour one is untouched);
     - class fills in a `<style>` block (`.st0{fill:#FFF}`, Illustrator exports) are neither counted
       nor themed;
     - an unquoted `fill=white`, and a `>` inside an attribute value, are skipped.
3. **Low 1: `/ask` waits for a live-chat refetch in flight** (`a3e7c616`, the reviewer's one-liner):
   `subsSettled = data !== undefined || (subsErrored && (progressive || !subs.isFetching))`.
   - **What it changes.** `errorUpdateCount` lives in the shared query client, so it outlives the
     front page. It survives into refetches the front page never asked for: `/ask`'s own mount (an
     errored query with no data is refetched when a new observer mounts), a scope toggle off and
     on, and a whole-archive Retry.
   - **Before**, `/ask` counted such an archive ready during that refetch, and a question could miss
     live chat about to arrive.
   - **Now** `/ask`, which is not progressive, counts it loading until the refetch settles. The
     progressive front page is unchanged: it stays ready through its own live-chat Retry, which the
     earlier e2e pins.
   - **The new e2e** (`federated-search.spec`, "/ask is not ready while it refetches a live chat that
     failed on the front page"): subs fail on `/`, then a client-side move to `/ask` by the header's
     Ask AI link. The mount's refetch is held, and the page reads "Loading transcripts…". On release
     it is ready.
4. **FACTS** (`ac9c299b`). Release 10's "L1 — hub lows" gets two dated amendments (2026-09-28,
   release 11 O1):
   - the subs rule on `errorUpdateCount` and the `/ask` wait, with its anchors and the
     `resetQueries` caveat;
   - the zero-archive low closed: `builtinsLoaded`, `listed`, the blocked lines, `AskScope` and the
     DRAFT constants anchored.
5. **Changelog** (`5477b43f`):
   - the social icon bullet now says "a single-colour icon", and that a multi-colour one (YouTube's)
     keeps its colours;
   - the live-chat bullet adds that Ask AI waits while it asks for a missing live chat again.

| sha | what |
|---|---|
| `c7b42f23` | merge `main` `cb9d02b2`: one `[Unreleased]`, the records O4, O3, O6, O1 |
| `69d08bf6` | `common: normalizeSocialSvg` themes only a single-colour icon; animation tags passed over; self-closing `<mask/>`; +5 unit tests (13) |
| `a3e7c616` | `hub:` `/ask` waits for a live-chat refetch in flight (`progressive \|\| !isFetching`); +1 e2e |
| `5477b43f` | `export: [Unreleased]`: the single-colour icon; Ask AI's wait |
| `ac9c299b` | `plans:` FACTS, release 10 "L1 — hub lows" amended |
| _this_ | `plans:` these review fixes |

**Gates on `ac9c299b`**
- **tsc:** clean (`o1-tsc-4.log`, 62 s).
- **Unit tests** (`o1-units-2.log`):
  - common **2,102/2,102** (main `cb9d02b2`'s, plus O1's 21: 8 registry + 13 SVG);
  - editor unit **85/85**;
  - `test:scripts` **175 + 1 skipped**;
  - mcp **269/269**.
- **e2e** (`o1-run-2.log`):
  - `e2e:hub` in full: **32 passed** (31 + 1 new), 1.2 min;
  - export `site-branding` + `ask-chat` + `ask-workspace`: **36 passed**, 1.7 min (43 s in the
    queue).
  - The primary's `export/public` was unchanged: all 380 files' size, mtime and md5
    (`o1-primary-before-2.txt` vs `-after-2.txt`).
  - Builds and `e2e:2origin` were not re-run: they are outside this round's gate list, and tsc
    covers the two changed modules.

**They bite:**
- **Unit** (`o1-bite2-units.log`, a scratch copy of `HEAD`'s `common/`):
  - Against O1's first normalizer (`c7b42f23`'s `settingsSchema.ts`), **5 of 13 fail**: all five
    new tests (YouTube, the badge, root-vs-child colours, the animation tags, the self-closing mask).
  - Each one-line mutation of the new code fails exactly its own test:
    - no single-colour gate: YouTube, the badge and root-vs-child;
    - animation tags not passed over: the animation test;
    - no self-closing alternative: the mask test;
    - spellings not folded: the spellings test.
- **e2e, one-line mutations of the subs rule** (`o1-bite2-e2e.log`, restored by a trap, tree clean
  after). This answers the review's nit: the first round's whole-source bite never reached the
  mid-Retry asserts.
  - **Release 10's `isSuccess || (isError && !isFetching)`:** the live-chat test fails mid-Retry.
    The Retry vanished (`toBeDisabled`: element not found) because the archive left `ready` while
    the subs were held.
  - **O1's first `data || errored` (no `/ask` wait):** the new `/ask` test fails. "Loading
    transcripts…" is not visible, because `/ask` was ready during its own refetch.

**Rollout note (owed): the social icons.** A settings write re-normalizes every stored social link.
That means ANY write through `writeSettings`, not only the Settings form's Save, so the first one
after the :3001 restart rewrites the stored x.com icon. Then rebuild every site, the hub AND the
homepage: the homepage's footer uses the same `settings.socialLinks`
(`homepage/app/components/Footer.tsx:20`; no `homepage.json` or `site.json` overrides them).
Whether `homepage/CHANGELOG.md` gets a bullet is the parent's call (O2 owns the homepage).

### Slice O2, as shipped — homepage and brand lows (2026-09-28)

Release 10 left four lows on the homepage and the mark: AC's "a custom hex is painted unfitted on
every base" and "a sixth published site would nearly repeat Anilyzer's magenta", and MR's "the ring
is a box-shadow, which forced-colours mode removes" and "a fresh worktree's homepage e2e skips 8
specs". Branch `r11/homepage-lows` off `main` `2162db92`, `main` `c1d4790a` merged in (a fast-forward)
before the first commit, worktree `/home/user/Projects/r11-homepage-lows` (block #3), one Opus
implementer. Scratch files `o2-*` in the job's `tmp/overnight`.

**What shipped**

- **A custom hex is fitted per base, on the homepage cards and the hub's official cards.**
  - `siteColor` paints one through `resolveAccent`, the fit the site's own pages use: 4.5:1 on the
    ground and with its ink.
  - The three values travel as ONE CSS value, `perBaseColor` (`common/lib/siteColor.ts`): each
    channel is a `calc()` over new one-hot tokens `--base-light|sepia|dark`. They are 1 on their own
    base and 0 on the others, declared in each base block of `tokens.css`. The browser resolves the
    value to a plain `rgb()` and switches it with the base.
  - A single string was needed because `siteColor`'s result goes, as is, into every hub surface:
    card, chip, result stripe. So the fix is in the shared function, and no file under
    `export/app/components/hub/**` changed.
  - The fallbacks paint the light value on a page with no token sheet.
  - The e2e's pale `#f4c2d7` (1.43:1 on the light ground as published) paints `#846974` on light,
    `#7c636e` on sepia and `#f4c2d7` on dark.
- **A sixth validated chart slot, `--chart-6`, a rust.** Light and sepia `#823c10`, dark `#a54a08`.
  - `seriesColor(5)` is `var(--chart-6)` (`CHART_SLOTS = 6`), no longer the golden angle's
    `hsl(328 64% 55%)`.
  - `ACCENT_CHART_SLOT.vermilion = 5`. The rust is Vermilion's hue family: 8–10° of OKLCH hue from
    its swatches, and 27–33° from the nearest other slot (amber). *(Ruled 2026-09-28: Vermilion keeps
    slot 6.)*
  - So Jasolyzer, once published, wears the rust at any rank, and any six sites wear the six
    validated slots. Signal, a custom hex and no accent still have no family; they take the lowest
    free slot, and the sixth when it is free.
  - `REQUIRED_TOKENS` is 50 and `--color-chart-6` is in `@theme`. The homepage `theme.spec` checks
    that every base declares it.
- **Forced colours: a 1px `CanvasText` outline on the mark's tile, on every base.** It is two classes
  on `BRAND_MARK_RING_CLASS`:
  - `forced-colors:outline` and `forced-colors:outline-[color:CanvasText]`.
  - They compile to `@media (forced-colors:active){…outline-width:1px…outline-color:canvastext}`.
  - The outline has offset 0, so it sits where the dark ring does and follows the same corner.
  - Outside forced colours the two classes match nothing.
  - Every `BrandMark` has it: the export header and footer credit, the hub, the homepage and the
    editor sidebar.
- **The homepage e2e reads a synthetic summary.**
  - `homepage/e2e/fixture-summary.ts` replaces `fixture-accents.ts`. It runs the real
    `buildHomepageSummary` over made-up recordings and is deterministic (`FIXTURE_NOW` 2026-09-15).
  - Its six public sites are, in order: Brass; the pale custom hex; three with no accent; Vermilion.
  - The first site has a 12,000-transcript week in May, so the All-time axis reaches 10K. Every site
    transcribes every day of the last 200.
  - `playwright.config.ts` writes it to `e2e/.e2e-summary.json` before the server starts. That path is
    gitignored, as is a killed run's temp copy, and is not linked. It always passes
    `HOMEPAGE_SUMMARY_FILE`.
  - Nothing is read from `public/` or from the primary.
  - `stats.spec` no longer skips, and its site count is the fixture's six. `marketing.spec` reads the
    fixture, the file the server reads. `instance-colours.spec` checks the fitted pale hex per base,
    Vermilion's card in its rust layer's hue, and the six legend swatches as the six validated slots.

**The sixth slot, validated.** Slice AC's method (`ac-validate.sh` / `ac-layers.mts`): the dataviz
skill's validator on each base's own values, read from `tokens.css`. It runs over all pairs, since
the homepage order moves with transcript counts. Contrast is checked against `--chart-surface` AND
the page ground. The command, from `common/`, is `pnpm exec tsx $T/o2-validate.mts`. For every run it
calls `node $T/dataviz/scripts/validate_palette.js "<chart-1..6>" --mode light|dark --surface <chart
surface | page ground> --pairs all|adjacent`. Log: `o2-validate.log`.

| base | `--chart-1..6` | surface / ground | band | chroma | CVD, all pairs | normal, all pairs | contrast | exit |
|---|---|---|---|---|---|---|---|---|
| light | `#3a7de0 #2f8a57 #5e3aa8 #a8741a #c24a8a` **`#823c10`** | `#ffffff` / `#f3f6f7` | PASS | PASS | WARN 6.2 (amber↔green) | PASS 15.4 | PASS / PASS | 0 / 0 |
| sepia | `#3574d6 #2a7d4f #5e3aa8 #a8741a #bb4585` **`#823c10`** | `#faf4e6` / `#f4ecd8` | PASS | PASS | WARN 6.1 (amber↔green) | PASS 15.3 | PASS / PASS | 0 / 0 |
| dark | `#3561c8 #3fa577 #9a7ee6 #b98a2a #c24c8a` **`#a54a08`** | `#16110a` / `#0c0a08` | PASS | PASS | WARN 6.9 (magenta↔green) | PASS 15.4 | PASS / PASS | 0 / 0 |

- **The WARN pairs are the five's own floor band, which release 10 recorded; none involves the
  sixth.** The sixth's own pairs, each run alone against `--chart-1..5`, are:
  - worst CVD 12.5 / 9.1 / 13.9 (light / sepia / dark; against green, green, magenta);
  - worst normal 16.6 / 16.6 / 16.3 (against amber);
  - all above the target of 8 and the floor of 15.
- **Contrast:** 8.1 / 7.4 / 3.2 to 1 on the chart surface and 7.4 / 6.9 / 3.4 to 1 on the ground.
- **The stack (adjacent), as `siteChartColors` resolves it** for the operator's mapping, with
  Jasolyzer (Vermilion) at each of the six places: PASS on every base. Worst CVD 12.5 / 9.1 / 11.0,
  normal 16.6 / 15.3 / 16.3. Before this slice the same run could not even resolve:
  `jasolyzer→hsl(328 64% 55%)` (`o2-validate-pre.log`).
- **Why a rust.** A search over every OKLCH hue took each base's best L and C inside the band at
  ≥ 3:1 on both the surface and the ground (`o2-chart6-search.mjs`, `-hue`, `-margin`; logs of the
  same names). Only the red-browns, h ≈ 15–60, clear every pair with `--chart-1..5` on all three
  bases. With 0.01 of L margin and ≥ 3.2:1, the best is h 48. The other hues fail:
  - teal fails CVD against blue and green (4.0–6.4), and would sit on Signal;
  - olive fails the normal floor on light and sepia (11–14.9);
  - an electric blue or violet fails on dark, or reads as a second chart-1 or chart-3.
- **A question for the operator: the rust sits near `--state-gone`.** *(Ruled 2026-09-28: accepted.)*
  The validator FAILs that pair, so it is information, not a gate:
  - normal ΔE 8.4 / 7.2 / 13.1, CVD 5.4 / 3.6 / 11.7;
  - release 10 (S2's review) accepted amber and magenta at 11.8–14.5, because gone is only ever
    labelled text, never a chart mark; the rust is closer;
  - no sixth hue clears both `--chart-1..5` and gone ≥ 15 on every base; the gone-constrained
    search's best, an electric violet, fails the palette's own normal floor (14.4 on light and
    sepia; `o2-chart6-hue-gone.log`);
  - on the homepage, gone shows only as the FamilyStats figure (`RecentAdditions` would badge it, but is rendered nowhere).

**Forced colours, as rendered** (`o2-shots.mjs`, `o2-shots.log`, `o2-forced.png`).
- **Normal modes are unchanged.** Each mark was shot as built and again with the two new classes
  removed, which is `main`'s class string, then compared by pixel (`magick compare -metric AE`).
  All 15 pairs differ by **0 px**: the homepage header, the site header and footer, and the hub header
  and footer, on light, sepia and dark.
- **The same pairs under forced colours differ,** on a light (white Canvas) and a dark (black Canvas)
  forced palette: all 18.
- **The worst case before, row 2 of `o2-forced.png`.** A site's ink tile on light or sepia under a
  black Canvas had no edge at all. Now it has a white outline.
- **Found: Chromium keeps the svg's box-shadow in forced colours.** Its UA sheet gives `svg`
  `forced-color-adjust: preserve-parent-color`, so MR's premise ("which forced-colours mode removes")
  does not hold there. The dark ring stays, and the outline is painted over the same pixel ring. What
  the mode does do is put the reader's Canvas under the tile on every base, which is why the outline
  is on every base.
- **Playwright applies the forced palette** (`page.emulateMedia({ forcedColors: "active" })`). This
  version's `test.use` has no `forcedColors`.

| sha | what |
|---|---|
| `fbd6318a` | `common:` `--chart-6` + the base flags (`tokens.css`), `seriesColor` six, `ACCENT_CHART_SLOT.vermilion`, `perBaseColor`, `siteColor` fits a custom hex; `REQUIRED_TOKENS` 50; unit tests (siteColor, hubSummary, themeTokens); the homepage chart and card headers' notes |
| `e253e244` | `common:` the forced-colours outline on `BRAND_MARK_RING_CLASS`; `BrandMark.test.ts` +1; the homepage `brand.spec` forced-colours test + outline none in the normal-mode test |
| `c37d620e` | `homepage(e2e):` `fixture-summary.ts` (replaces `fixture-accents.ts`), `playwright.config.ts`, `stats`/`marketing`/`instance-colours` specs, `.gitignore` |
| `7685e701` | `changelogs:` export and editor `[Unreleased]` bullets (the existing sections), the homepage's four |
| _this_ | `plans:` this record; `FACTS.md`'s official-instance colour entry; dated notes in `brand-and-themes.md` (mark, charts) |

**Gates** (logs `o2-*.log`):
- **tsc** clean before each code commit (33–71 s; `o2-tsc{1..4}.log`). The one failure along the way
  was `forcedColors` in `test.use`; the spec now uses `emulateMedia`.
- **Units:**
  - common **2,056/2,056** (2,051 on `main` + 5);
  - editor unit **85/85**, `test:scripts` **175 + 1 skipped**, mcp **269/269**, homepage unit **2/2**.
- **Builds:**
  - Timings: editor ok (38 s), export site ok (23 s), export hub ok (25 s; `out/ask` present),
    homepage ok (12 s; no `public/` data, so the no-data page and the header mark).
  - Each stylesheet carries the `forced-colors:active` outline rule, `--chart-6` (×2 `#823c10`,
    ×1 `#a54a08`) and the three flags per base.
  - The primary's `export/public` is byte-identical before and after the builds and the e2e: 392
    entries, 380 files, tree md5 `5c90d8e63753`, content md5 `4a0c46b39eeb`.
- **e2e** (queued behind O1 for about a minute; nothing failed, so no re-runs):
  - homepage FULL, from this worktree with NO `homepage/public` data (only its tracked `_headers`):
    **30 passed, 0 skipped** (42 s). Release 10's fresh-worktree run was 21 passed / 8 skipped, and
    29 passed with the primary's data copied in; 30 is those 29 plus the forced-colours test.
  - export `brand` + `site-branding` + `theme` + `theme-accent`: **20 passed** (50 s).
  - `e2e:hub`: **26 passed** (1.0 min).
  - editor `branding.spec`: **4 passed** (25 s).

**They bite** (`o2-bite.sh`, `o2-bite*.log`). Each item was reverted to the old code on its own,
with the new tests kept:
1. **Custom hex as published.** Unit: 4 fail (the two `officialInstances` custom-hex cases, the fitted
   test, and the unrecognised-id fall-through). e2e `instance-colours`: expected `rgb(132, 105, 116)`,
   received `rgb(244, 194, 215)`.
2. **Five slots, no vermilion family, no `--chart-6`.** Unit: 6 fail (the required tokens, the
   charts test, the family slots, `seriesColor` six, the seventh-site case, and any-six-wear-six).
   e2e: expected `var(--chart-6)`, received `hsl(328 64% 55%)`.
3. **No outline.** Unit: 1 fails. e2e forced-colours test: `isCanvasText: false`.
4. **`main`'s e2e setup** (its specs, config and `fixture-accents.ts`) in this worktree: **21 passed,
   8 skipped**. The skips are `stats.spec` ×7 and `instance-colours.spec`.

**Found and left**
- **The hub's ADDED archives still paint a custom hex as set.** This is `ArchiveShelf`'s
  `site.accent || FALLBACK_ACCENT`, and the chips and stripes that read the registry's raw `accent`.
  It is `export/app/components/hub/**`, O1's, so it was not touched here. The fix is one call where
  it parses: `perBaseColor(resolveAccent(hex))`. For O1 or the parent.
- **The rust near `--state-gone`:** the operator question above (ruled 2026-09-28: accepted).
- **Two things do not reach the sixth slot:**
  - `ChartView.tsx` (export and editor charts) cycles `var(--chart-${(i % 5) + 1})`, so it never
    wears `--chart-6`; its sixth series repeats chart-1, as before. Not a homepage surface.
  - Past six, `seriesColor`'s golden angle still gives hue 105 (7th) and 243 (8th, near chart-1's
    blue). Only `/stats`' by-channel views reach them (up to 8 channels plus Other).
- **The no-data paths have no spec now.** The e2e server always has the fixture, so `/` and `/stats`
  without a summary go untested; `marketing.spec` keeps its absent branches. Before, those paths ran
  only in a fresh worktree, where the data specs skipped instead. A second web server without the
  fixture would cover them.
- **O6's `E2E_` rename will meet `HOMEPAGE_SUMMARY_FILE`,** which `app/lib/summary.ts` reads and
  `playwright.config.ts` sets.
- **The live sites carry none of this until rebuilt:** every export site and the hub (the outline,
  and the hub's fitted hex), the homepage (all four), and the editor on its next restart (the
  sidebar outline).

### Slice O5, as shipped — umtool brand fonts (2026-09-28)

Branch `r11/umtool-fonts` off `main` `2162db92`, fast-forwarded to `main` `cb9d02b2` (O4, O3, O6
checkpoint A) before any change; worktree `/home/user/Projects/r11-umtool-fonts`, port block #8
(umtool e2e 3851, stub 3852). One Opus implementer; scratch files `o5-*` in the job's
`tmp/overnight`. Everything is under `umtool/report-to-video/**`; nothing in `umtool/app/**`.

**Why.** S4 left two things for later ([`brand-and-themes.md`](brand-and-themes.md), "Slice S4, as
shipped"): the rail, `ledger`, `scroll` and `chart` SVG text stayed Fira Sans under the brand,
because `fit()` truncates against Fira's 0.50 em average; and `render.fontBold` stayed whatever the
manifest said, because no bold Plex Mono was vendored. O5 does both, and an unbranded render stays
byte-identical.

**The measurement, and why the brand's metric is a table rather than an average.** Nothing
recorded how 0.50 was measured, so O5 fixed a method and checked that it gives Fira's own number:
the mean advance per character (fontTools hmtx; Fira from the system files fontconfig resolves, Plex
Sans from the vendored variable font instanced at wdth 100) over the text these assets draw. The
`fit()` corpus is the five S4 manifests' track labels, log and scroll labels, roster lines, column
heads and quotes, read and never written (`o5-corpus.json`, 144 strings, all from
`quartering-employee-count`, the only one with a rail).

| face | weight | `fit()` strings | p95 of a string's own mean | every SVG text run | capitals |
|---|---|---|---|---|---|
| Fira Sans | 400 | 0.457 em | 0.492 | 0.463 | 0.549 |
| Fira Sans | 700 | 0.462 | 0.497 | 0.525 | 0.550 |
| IBM Plex Sans | 400 | 0.456 | 0.497 | 0.469 | 0.590 |
| IBM Plex Sans | 700 | 0.479 | 0.521 | 0.577 | 0.613 |

So 0.50 is Fira's mean plus the "hair" its comment describes, just over its p95. By the same method
Plex Sans Regular gets 0.50 too, and Bold 0.53. **But an average cannot keep the promise the slice
makes, that a branded column never overruns** (`o5-stress.log`). Every real string (87, 77 over 20
characters) was pushed through every call site's size, budget, weight and letter-spacing:
- **Fira's own 0.50 overruns** the scroll's bold, letter-spaced column head in 40 of 87 runs (up
  to 11 %) and the rail's track label once;
- Plex at 0.50 / 0.53 overruns the head in 35 of 87 runs;
- uppercased, every site overruns in both faces at every average tried (0.50 to 0.55).

None of the manifests' labels comes near a budget as written (the tightest is a wrapped quote line
at 95 %), which is why this never showed. So the preset's metric is **the face's own advances**:
- `face-metrics.mjs` is generated by `fonts/gen-face-metrics.py` (fontTools 4.65.0, instancer)
  from the vendored `IBMPlexSans[wdth,wght].ttf`. It holds the advance of all 891 characters the
  font maps at wght 400 and 700, wdth 100 (11.5 kB, do-not-edit header, the font's sha256).
- `fit()` keeps the longest prefix whose width, ellipsis, weight and letter-spacing included, is
  inside the budget.
- Fira keeps its 0.50 average and its exact character counts. It is the system's font, so a table
  of its advances could not be pinned anyway.
- Kerning is ignored. Over the proof's 24 Plex runs, the plain sum was at or above the rendered ink
  width of every one (by 0.19 px at the least), so the sum is the conservative side.
- A character Plex does not map (emoji, CJK) counts 1.3 em.

**What shipped.**
- **`svg-faces.mjs`:** `FIRA_SANS` (`{family, em: 0.5}`), `IBM_PLEX_SANS` (`{family, advances:
  {regular, bold}}`, built from the table), `textWidth(text, size, face, {weight, ls})`, and
  `FALLBACK_EM`. `brand.mjs` gains `brandSvgFace(render)`: null without a brand, the preset's face
  with one.
- **`render-cards.mjs`:**
  - `fit(text, size, maxPx, face = FIRA_SANS, run)` and `wrapPx(…, face)` are exported. An
    average face runs the old code path verbatim. A measured face fits by width, and `wrapPx`
    wraps by width and fits every line, so a lone overlong word is cut too.
  - `svgTextIn(face)` sets each asset's family. The rail (chrome, log, tally, roster, the QR
    tile), the ledger card, the scroll and the chart take `svgFaceOf(render)`.
  - The scroll head fits with `{weight: "bold", ls: 0.6}`, and the ledger's scope pill is the
    label's measured width + 22 (Fira: `length × 7.6 + 22`, unchanged).
  - `rasterize()` hands rsvg-convert `childOpts(render, …)`, which passes the options through
    unchanged without a brand. Without it a branded SVG found no Plex (it is not a system font)
    and fell back to another sans, silently.
- **IBM Plex Mono Bold, vendored:**

  | | |
  |---|---|
  | file | `fonts/IBMPlexMono-Bold.ttf`, unmodified (Reserved Font Name "Plex") |
  | source | google/fonts `ofl/ibmplexmono` at `0b58fb37` (`0b58fb370093f9a9f4ff785d94405710b79de67c`), the commit S4 took Regular from; Regular there is byte-identical to the vendored one |
  | bytes | 137,784 |
  | sha256 | `ac27abd6450a64dd94467580a02fe6235156d5b92f2926ebbc8e7489df64e0be` (git blob `17b406d2`, as upstream lists it) |
  | licence | `OFL.txt` already holds Plex's OFL verbatim; unchanged |

  `fonts.conf`'s relative `<dir>` picks it up: under `FONTCONFIG_FILE`, `IBM Plex Mono:bold` now
  resolves to it (it resolved to Regular, emboldened, before), and without it the system still
  answers Noto. `resolveBrandRender` sets `fontBold` to it beside `fontRegular`, so compose-chrome's
  HyperFrames band sets its bold in the brand's mono. The fonts are about 1.5 MB in all.
- **README:** the preset's "owns" list; the "Not branded yet" paragraph goes; the fonts paragraph;
  "Why a table, not an average".

**Shown.**
- **`o5-fit-proof.png`** (+ `.tsv`): every `fit()` call site, three cases each (the site's longest
  real label; the longest real string anywhere, a 143-character quote; and the site's label in
  capitals), fitted in both faces inside a box exactly its budget wide. Each fitted run is then rendered
  **alone** through rsvg-convert and its ink measured:
  - **Plex: 24 runs, 9 truncated, 0 over budget, widest 98.9 %.**
  - Fira (the unchanged path): 1 over, the scroll head at 152 px in 140.
- **`o5-overrun.py`** computes every `<text>` run's extent from its face's real advances (anchor,
  weight and letter-spacing aware) over the SVG sources the renderers write. It flags a run that
  leaves its canvas or tally lane, or overlaps another run on its line. **0 problems** in all 27
  SVGs of each set: unbranded, branded before, branded after (1,552–1,554 runs). It catches a
  synthetic collision.
- **Branded before/after** (`o5-brandshots.mjs`: the five manifests with `render.brand` and
  `endCard: false` set in memory, 19 render calls). Every asset differs, as it should. Two ledger
  quotes that Fira wrapped onto a stranded last word (L03 "employees", L06 "now") are one line in
  Plex, and the pills hug their labels.
  - Looked at: the ledger cards, the rail chrome, the log, the tally strip, the QR tile, the scroll
    and the chart. No clipped glyph and no overrun.
  - "IMPLIED" clears its delta triangle by 21.4 px (Fira 28), and "≈" and "→" are in Plex.
  - `o5-compare.png`: a ledger row, the scroll heads and the chart's end labels, before and after.
- **The branded chapter kicker** (Pango, the `label` face in bold) now draws the real Plex Mono Bold,
  where it drew an emboldened Regular before. It is the only change on that card: 276 px inside the
  kicker's 189 × 24 box, and it looks the same at 24 px.

**The byte-identity proof** (S4's harness, copied as `o5-identity.mjs` / `o5-idiff.mjs`, paths
adapted; S4's fixture copied to `o5-fixture`):
- **BEFORE** was rendered on `cb9d02b2` before any change, into `o5-before/`. It covers every card,
  footer, rail, ledger, scroll and chart asset of the five manifests in both variants (70 render
  calls, the resolved `render` blocks included), plus a full offline fixture build.
- **Control** (the same code twice, `o5-before` vs `o5-before2`): 334 files, 201 raw identical, 133
  identical but for ImageMagick's `tEXt date:*` chunks, 0 different.
- **AFTER, on the final code tip `216533ea`** (`o5-after-2`): **334 files, 201 raw identical, 133
  identical but for the date chunks, 0 different, none missing or extra.** The fixture's cut is the
  same 3,380,693 bytes, and the mp4s are raw-identical. The same result on the pre-commit tree
  (`o5-after-1`).
- The five manifests' sha256 were the same after every run (`o5-manifests-sha-before.txt`).

| sha | what |
|---|---|
| `b9933d71` | `umtool:` vendor IBM Plex Mono Bold; `resolveBrandRender` sets `fontBold`; brand tests (the file, the value, fontconfig resolves it) |
| `2223ba07` | `umtool:` Plex Sans for the rail / ledger / scroll / chart under the preset — `svg-faces.mjs`, `face-metrics.mjs` + `fonts/gen-face-metrics.py`, `fit()`/`wrapPx()` take the face, the pill, `rasterize()` gets `childOpts`, `brandSvgFace`; `svg-faces.test.mjs` (7) and a scroll-card render test |
| `b555af1a` | `umtool:` test that the preset's rsvg-convert children get `FONTCONFIG_FILE` (an `RSVG_BIN` stub); fc-match's escaped paths unescaped |
| `216533ea` | `umtool:` README — the preset's faces, "Why a table, not an average", Plex Mono Bold; `svg-faces.mjs`'s header says what was rendered |
| _this_ | `plans:` this record |

**Gates** (from the worktree root; logs `o5-*.log`):
- **tsc clean** before every commit: 66 s, 32 s, 38 s and 30 s. The `.mjs` files are `allowJs`
  without `checkJs`, so it resolves them but does not check them.
- **`test:scripts` 185 + 1 skip** (`main` `cb9d02b2`: 175 + 1; +10 = `svg-faces.test.mjs` 7 +
  `brand.test.mjs` 3). Common, editor unit and mcp not run: nothing outside umtool changed.
- **umtool build** (`pnpm --filter umtool run build`): ok, 17 s.
- **umtool e2e, full** (`SONG_DIR=~/reports/quartering-uh-song/data node scripts/worktree.mjs run --
  pnpm --filter umtool run e2e`, on `2223ba07`, no queue wait): **175 passed, 2 failed, 45 skipped,
  4.4 min**, which is release 10's count. The two failures are `mix.spec.ts:166` and `:201`, the
  known order-dependent pair; the skips are the song-data capabilities this machine lacks.
  **`mix.spec.ts` alone: 12 passed** (26 s), both included. The two later commits are a test, the
  README and a comment, so it was not re-run.
- **Changelog:** umtool has none (`umtool/CHANGELOG.md` does not exist), so nothing was added.

**They bite** (`o5-bite.py`: scratch copies of `report-to-video/`, the worktree untouched; `svg-faces`
+ `brand` tests, 21):

| variant | result |
|---|---|
| the tip, unmutated (control) | 21/21 |
| `cb9d02b2` (the old code) | both files fail at import (`MONO_BOLD_FONT_FILE`, `fit` not exported) |
| `b9933d71` (bold in, measured face not yet) | both fail at import (`brandSvgFace`) |
| `fit()` counts for every face | 4 fail: Plex inside its budget, measured not counted, wrap, the scroll render |
| the scroll head fitted without its face | 1 fails: the scroll render (`THE QUARTERING · MED…` in Plex) |
| `wrapPx()` counts for every face | 1 fails: wrap |
| `rasterize()` without `childOpts` | 1 fails: the rsvg env test |
| `fontBold` not set | 1 fails: the preset's render |
| `IBMPlexMono-Bold.ttf` removed | 2 fail: the vendored faces, `fonts.conf` resolution |

**Found and left**
- **Fira's unbranded path can overrun its own columns** given long enough text (the scroll head
  above; uppercased text at every site). None of the real manifests' labels comes near a budget,
  and the byte-identity rule forbids changing it. If it ever matters, the fix is a Fira table like
  Plex's, and that has to be pinned to one Fira build.
- **The scroll's first column head** is fitted to the column pitch (140 px) and ignores the `DATE`
  head to its left. "THE QUARTERING" clears `DATE` by 8.4 px of advance in Plex (23 in Fira), and a
  head near 140 px would reach it in either face. Not hit by any manifest.
- The 1.3 em fallback for unmapped characters is a bound, not a measurement: nothing rendered an
  emoji or CJK label through a fallback font.
- **`plans/STATE.md`** ("New lows", l. 154–155) lists both of this slice's items as open. **S4's
  record** in `brand-and-themes.md` (l. 1451–1453, 1541) states them as they were. Neither file is
  this slice's to edit, so they are left for the integration pass.

### Follow-ups O2b (2026-09-28)

After O2's review (`o2-review.md`, SHIP) and the merge (`main` `139a648e`: O4, O3, O6-A, O1, O2), one
small round on the same branch and worktree. `main` merged first (a fast-forward).

**What changed**
- **The hub's visitor-added archives are fitted per base** (O2's found-and-left, now safe: O1 is
  merged).
  - `useHubSites` maps every external archive's accent through `fittedHex`, which is
    `perBaseColor(resolveAccent(hex))` (`common/lib/siteColor.ts`; `siteColor` uses it too).
  - So the card stripe, the scope chip's dot, the search result edge and the channel group all get
    the fitted value from the one place.
  - A value that is not a `#rrggbb` is dropped, so it never reaches a style. Before, a remote
    `/site.json` could put any string there. The card then falls back to `var(--brand)`, as with no
    accent.
- **R2's low 2, recorded here:** O2 also changed the hub's DEGRADED path.
  - This is an official archive with a named accent whose `hub-summary.json` is missing, or whose own
    hex disagrees with it.
  - It used to paint the on-dark hex on every base, and now paints that hex fitted per base (for
    example Brass `#e3b15c` → `#8a6c38` on light, against the swatch `#95661a`).
  - The export changelog now says so.
- **`normalizeSocialSvg` passes over a `<clipPath>` exactly like a `<mask>`** (O1 review, re-read
  low).
  - It handles the block and the self-closing form, the self-closing one first.
  - So Figma's usual one-colour export counts as ONE colour and is themed: a black path in a group
    clipped by `<clipPath><rect fill="white"/></clipPath>`.
  - x.com and Kiwi Farms are byte-for-byte as before (their tests pin the whole output), and the
    rule is still idempotent (the Figma icon is in the idempotence loop).
- **R2's nits:**
  - `tokens.css`: the chart-6 CVD pairs are "deutan", as the validator prints.
  - `homepage/app/lib/summary.ts`: the comment names the synthetic summary.
  - `ArchiveGrowthChart.tsx`: the today-order numbers are "today's mapping — release 10's slice MC,
    re-run in release 11".
  - This record: gone shows only as `FamilyStats`' figure (`RecentAdditions` is rendered nowhere).
  - `brand-and-themes.md`: 50 colour tokens (a dated note).
  - `perBaseColor` throws a `RangeError` on anything but a `#rrggbb` per base, rather than paint
    `rgb(NaN …)`.
  - FACTS: `perBaseColor`'s value is CSS only (never parse or compare it as a hex); a fourth base must
    add its flag; the added archives use the same fit.
- **The no-data pages are specced again** (R2's low 4). `homepage/e2e/no-data.spec.ts` runs serially.
  - It renames `e2e/.e2e-summary.json` to `.e2e-summary.json.aside`, which is gitignored by the same
    pattern, and restores it in `finally`.
  - It asserts `/` shows "Every word a channel said, searchable to the second." with no growth
    chart, no Official Instances and no build date.
  - It asserts `/stats/` shows "This build shipped without dashboard data" and no chart.
  - It then checks the next `/stats/` draws the fixture again.
- **Changelogs:**
  - export `[Unreleased]` gains one bullet: the added archives and the degraded path, fitted per
    base.
  - O1's single-colour bullet now says clip paths are left alone and do not count (the Figma case).
  - `homepage/CHANGELOG.md` gains the single-colour social icon (the homepage footer's links are the
    same normalized `socialLinks`), on the parent's ruling on O1's question.

| sha | what |
|---|---|
| `c17ead28` | `common:` `normalizeSocialSvg` passes over `<clipPath>` (block + self-closing); the Figma-shape test |
| `ee0a252e` | `hub:` the added archives' accent through `fittedHex` (`useHubSites`); `perBaseColor`'s input check; `ArchiveShelf` comments; unit tests; the hub e2e |
| `ac8c4d2b` | `homepage(e2e):` `no-data.spec.ts` |
| `36e4fabd` | `comments:` the three code-comment nits (`tokens.css`, `summary.ts`, `ArchiveGrowthChart.tsx`) |
| `36fc74f8` | `changelogs:` export (the fitted hub archives; clip paths in O1's bullet), homepage (the single-colour icon) |
| _this_ | `plans:` this section; the record's gone line; FACTS; `brand-and-themes.md`'s token count |

**Gates** (logs `o2b-*.log`):
- **tsc** clean before the code commits (89 s, `o2b-tsc1.log`).
- **common 2,110/2,110:** `main` `139a648e`'s count + 3 (the Figma test, `fittedHex`, the input
  check).
- **e2e** (queued behind nothing; nothing failed, so no re-runs):
  - `e2e:hub` full **33 passed** (1.2 min; 32 at O1 + the added-archive test);
  - export `site-branding` **7 passed** (12 s);
  - homepage full **31 passed, 0 skipped** (44 s; 30 + `no-data.spec`), from this worktree with no
    `homepage/public` data;
  - after the homepage run the fixture file is back in place and no `.aside` is left.
- **The primary's `export/public`** is byte-identical before and after (392 entries, 380 files).

**They bite:**
- **Figma:** against the previous `settingsSchema.ts`, the Figma test fails with the fills
  `['none', 'black', 'white']`: two colours, so nothing is themed. The other 13 pass
  (`o2b-bite-svg.log`).
- **The added archive:** with `useHubSites`' `.map(fittedHex)` removed, the hub test fails on light,
  expecting `rgb(132, 105, 116)` and receiving `rgb(244, 194, 215)` for both the stripe and the dot
  (`o2b-e2e-bite-hub.log`).
- **The input check:** without it, `perBaseColor`'s throw test fails (1 of 15;
  `o2b-bite-unit-check.log`). Against `main`'s `siteColor.ts` the test file does not load at all
  (no `fittedHex`).
- **No data:** with the loader's old bug (a zero-filled summary when there is none),
  `no-data.spec` fails: `/stats/` never says "This build shipped without dashboard data"
  (`o2b-e2e-bite-nodata.log`).

**Found and left**
- **A dev-console warning, not O2b's:** the homepage run logs `[browser] Received NaN for the width
  attribute` during `stats.spec`'s Customize test (ranked / small multiples). It is in O2's runs too,
  so it predates O2b.

### Slice O6, as shipped — checkpoint B: the `E2E_` prefix cleanup (2026-09-28)

After checkpoint A merged (`cb9d02b2`), the branch fast-forwarded to `main` `15d5d646` and then
`59d2f877` (O2b in). No merge commit was needed. The plan was written first
(`$T/o6-b-plan.md`): every variable, every reader, old → new, and which stay unprefixed and why.

**The rule.** A variable only a harness reads gets the `E2E_` prefix and is declared in its
package's playwright config. "A harness" means a playwright config, an e2e helper, a fixture, a
fake binary, a stub server, the sharded runner, or a test-mode branch of app code. The config
either sets the variable (webServer `env`) or lists it with where it is read. Two new
`envVars.test.ts` tests hold the rule:
- the `test` audience is `E2E_`-prefixed (`PLAYWRIGHT_BASE_URL` and `QUEUE_LOCK_HELD` are
  excepted, with the reason);
- each test-audience variable is named in a playwright config (the queue's own variables in
  `queue-lock.mjs`).

**Renamed**, every reader and writer:

| old | new |
|---|---|
| `EDITOR_TEST_ROUTES` | `E2E_TEST_ROUTES` |
| the five `AUDIO_CHECK_*_OVERRIDE` | `E2E_AUDIO_CHECK_*` (suffix dropped) |
| `AUDIO_CHECK_DEBUG_PAUSE_MS` | `E2E_AUDIO_CHECK_DEBUG_PAUSE_MS` |
| `FAKE_YTDLP_*` ×7, `FAKE_GALLERY_DL_AUTH_FAIL` | `E2E_FAKE_*` |
| `FIXTURE_MAX_LIFETIME_MS`, `OLLAMA_STUB_MODEL`, `RACK_SHOTS`, `TWO_ORIGIN_REBUILD`, `HOMEPAGE_SUMMARY_FILE` | `E2E_…` |
| `SHARDS`, `IMAGE`, `SKIP_BUILD` (sharded runner) | `E2E_SHARDS`, `E2E_IMAGE`, `E2E_SKIP_BUILD` |
| umtool: `EDITOR_STUB_LOG`, `UMTOOL_CUT_DELAY_MS`, `UMTOOL_EXTRA_KINDS` | `E2E_…` |

- **The editor's test-server values moved.** `E2E_TEST_ROUTES` and the audio-check knobs moved
  from `dev:test` / `start:test` into `editor/playwright.config.ts`'s `E2E_SERVER_ENV` (the
  webServer's env). A hand-started `dev:test` could already not be reused under the queue's port
  check, so nothing depended on it carrying them.
- **Newly declared:** `E2E_RETRIES` (read dynamically, so the scan had missed it), and two runtime
  knobs the scan had also missed because they are read through helpers:
  `AUDIO_CHECK_RESUME_DURING_PROBE` and `AUDIO_CHECK_BACKOFF_FACTOR`. The scan now knows
  `env(Int|Float|Bool)Override` and `parseIntArg`.
- **umtool's three** are declared in `umtool/playwright.config.ts`, not in `envVars.ts` (umtool is
  outside the list until Phase 5).

**Unchanged, by design:**
- the queue lock and port check: `E2E_QUEUE`, `E2E_PORT_CHECK`, `E2E_QUEUE_TIMEOUT`,
  `E2E_PORT_GRACE_MS`, `E2E_QUEUE_LOCK_FILE`, `QUEUE_LOCK_HELD`, and the lock file;
- the port names (`ports.mjs`, the worktree injector, queue-lock's `--ports` lists);
- `PLAYWRIGHT_BASE_URL`, `CI`, and the real overrides a harness points at fixtures;
- the docker `ARCHILYZER_*` set;
- two unit-test knobs, `KEEP_TAG_PREVIEW_FIXTURE` and `CUES_TEST_DIR`, which are read by node unit
  tests, not an e2e harness.

**Ports.** Everything that used to spell a fallback now reads `common/lib/ports.mjs`
(`portFor` / `PORT_BASES`), so `ports.test.ts` finds only the package.json shell defaults and
the `--ports` lists, which cannot import a module:
- the configs: editor, export, hub, 2origin, homepage, umtool;
- the editor's `baseUrl.ts`, the two export specs, and the ollama stub;
- the umtool editor stub and the 2origin spec.

The umtool stub's port is now `EDITOR_STUB_PORT`'s base whatever `UMTOOL_E2E_PORT` is, which is
what queue-lock's preflight already checked.

**Folded in (the parent's asks):**
- The Settings Build mode options read "Basic (a label for now)" / "Docker (a label for now)".
- The per-site panel's note shows whatever the mode is (its `serial` prop is gone).
- `/sites`' Build all sentence no longer says "(Docker mode)".
- The public homepage's "Building several sites at once" page and its `/docs` blurb say Build all
  uses containers whenever an engine is available, and that the mode is a label; the homepage
  changelog has a bullet.
- `E2E_SHARDS` is in CONTRIBUTING.md and SETUP.md.
- One editor `[Unreleased]` bullet.

| sha | what |
|---|---|
| `f4367aca` | `e2e:` the renames, the declarations, `E2E_SERVER_ENV`, the two guard tests, the harnesses on ports.mjs, ENVIRONMENT.md regenerated |
| `43b2572b` | `editor:` the build-mode options, the per-site panel note, /sites' Build all sentence |
| `b3f2ee86` | `docs:` `E2E_SHARDS`; the homepage's Docker page and blurb |
| _this_ | `plans:` this section; the editor and homepage `[Unreleased]` bullets |

**Gate B**, on `59d2f877` + these commits, from the worktree root. The logs are `o6-gateB*.log`
and `o6-gB-*.log`.
- tsc clean (66 s, then 31 s).
- **common 2,112/2,112**, **editor unit 85/85**, **`test:scripts` 185 + 1 skip**, **mcp
  269/269**, homepage unit 2/2.
- `docs env --check`, `settings example --check` and `docs files --check`: all exit 0.
- Every touched playwright config loads (`playwright test --list`): editor 665, export 206, hub
  33, homepage 31, umtool 222.
- **Editor subset** (`o6-specsB.txt`: ops-api, worker-unit, audio-check-classifier,
  audio-check-scenarios, social-channel, digest, export-search, export-player-platform-cache,
  deploy-page, settings, channels-rack-audit), with `E2E_RACK_SHOTS=1` so the audit actually runs
  (its shots landed in `editor/test-results/rack-shots/`): **115 passed, 0 failed, 5.3 min**.
- **Export full:** **206 passed, 0 failed, 6.7 min**.
- **`e2e:hub`:** **33 passed, 1.2 min**.
- **Homepage full**, with the primary's `homepage/public` data copied: **31 passed, 0 skipped, 45 s**.
- **umtool full** (`SONG_DIR=~/reports/quartering-uh-song/data`): **175 passed, 2 failed, 45
  skipped, 4.1 min**. That is exactly O5's recorded baseline. The two failures are the known
  order-dependent pair, `mix.spec.ts:166` and `:201`; the skips are the song-data capabilities.
  **`mix.spec.ts` alone: 12 passed** (22 s). The renamed umtool knobs are exercised in that run:
  deliver's Stop test passed (18.3 s, `E2E_UMTOOL_CUT_DELAY_MS`), and so did the
  unregistered-kind test in projects.spec (`E2E_UMTOOL_EXTRA_KINDS`).
- **They bite** (`o6-bite.log`, "checkpoint B"):
  - a test-only var without the prefix fails 4, including the prefix test;
  - removing a name from the editor config's declaration fails the declared-in-a-config test (1);
  - an old name read again in a fixture fails "every variable the code reads is declared" (1);
  - a drifting port fallback in `baseUrl.ts` fails `ports.test` (1).

**Found and left (checkpoint B):**
- **`e2e:2origin` was run by the reviewer, not by me** *(corrected after review S1; the first
  version of this bullet was wrong)*. Its config's ports and declaration changed, and its setup
  reads the renamed `E2E_TWO_ORIGIN_REBUILD`.
  - The reviewer ran `E2E_TWO_ORIGIN_REBUILD=1 node scripts/worktree.mjs run -- pnpm --filter
    export run e2e:2origin` in this worktree: **3 passed** (34.3 s), the hub rebuilt.
  - The primary's `export/public` was byte-identical before and after: all 380 files matched on
    path, type, size, mtime and md5 (`$T/o6b-rv-{before,after}.{meta,md5}`).
  - Why: compose-hub writes through `writePublicFile`, which removes the path first and so never
    writes through a link, and `sw.js` / `hub-summary.json` are `rm`'d, which removes the link
    only. I had claimed the opposite.
  - The run leaves this worktree's `export/public` with real files where links were; they were
    re-linked afterwards (review L2).
  - Never run it from the primary checkout: there the entries are real files, and `build:hub`
    would overwrite the live hub files with an empty pool (the release-7 accident).
- Old names survive only in `plans/` and released changelog text.

**Review fixes (checkpoint B)** — the review (`o6b-review.md`) was SHIP AFTER FIXES, with no
blocker. Docs and record only:
- **S1:** the `e2e:2origin` bullet above is corrected with the reviewer's run and evidence. The
  "run it from the primary" advice is deleted here and in the report; it would have repeated the
  release-7 accident.
- **L1** (the commit just before this record's): WORKTREES.md now says a server reused under
  `E2E_PORT_CHECK=0` must be started with the config's `E2E_SERVER_ENV` values.
- **L2:** the reviewer's 2origin run left real files where this worktree's `export/public` links
  were: `corpus.json`, `_headers`, `hub-sites.json`, `llms.txt`, `robots.txt` and `sw.js`, and
  `hub-summary.json` was removed. All were re-linked from the primary with the implementer-rules
  loop, in the worktree only. `find export/public -xtype l` is empty.
- **N1** (pre-existing, recorded only): with `E2E_TWO_ORIGIN_REBUILD=1`, playwright loads
  `playwright.2origin.config.ts` twice, so `stageTwoOrigins()` builds the hub twice per run.

### Integration, as merged (2026-09-28)

Every slice was reviewed to SHIP on its own branch and merged by the parent as it landed; this pass
gated the combined tree once and wrote the records. Worktree `/home/user/Projects/r11-integration`,
branch `r11/integration`, port block #5, fast-forwarded to `main` `eb28a341` (`pnpm install
--frozen-lockfile`: already up to date). **No code changed at integration**: every gate below ran on
`eb28a341`, and the commits after it are `plans:` only. Scratch files `int-*` in the job's
`tmp/overnight`.

| merge | branch → tip | review | on `main` |
|---|---|---|---|
| **O4** homepage deploy from `/sites` | `r11/homepage-deploy-ui` → `83b786ca` | SHIP AFTER FIXES → re-read SHIP | `baaa4b47` |
| **O3** runner lows | `r11/runner-lows` → `f4615403` | SHIP AFTER FIXES → re-read SHIP | `c1d4790a` |
| **O6-A** Phase 4 slice 3, checkpoint A | `r11/phase-4-s3` → `11d0403c` | SHIP AFTER FIXES → re-read SHIP | `cb9d02b2` |
| **O1** hub lows + DRAFT copy | `r11/hub-lows` → `8f5011c3` | SHIP AFTER FIXES → re-read SHIP (one new low, folded into O2b) | `6cd3a9fe` |
| **O2** homepage and brand lows | `r11/homepage-lows` → `1b39f285` | SHIP | `139a648e` |
| **O5** umtool brand fonts | `r11/umtool-fonts` → `8644e63f` | SHIP (four lows, two wording — see below) | `15d5d646` |
| **O2b** follow-ups | `r11/homepage-lows` → `013efa35` | SHIP; the review's changelog nits as `59d2f877` on `main` | `69e7f59e` |
| **O6-B** checkpoint B, the `E2E_` prefix | `r11/phase-4-s3` → `0ccd34f3` | SHIP AFTER FIXES → re-read SHIP | `eb28a341` |

**What joined by hand** (`git show --remerge-diff` on each merge).
- `baaa4b47`, `c1d4790a`, `cb9d02b2`, `6cd3a9fe` and `eb28a341` merged clean: each branch had merged
  `main` itself first (O3 `0c770285`, O6 `fcdaea12`, O1 `c7b42f23`; O6-B fast-forwarded), and
  resolved its joins there.
- `139a648e` (O2): `editor/CHANGELOG.md` (O6's CLI bullet, then O2's forced-colours bullet),
  `export/CHANGELOG.md` (O1's five hub bullets, then O2's outline and fitted-hex bullets) and this
  file's Record (O6-A, O1, then O2). Every side kept.
- `15d5d646` (O5) and `69e7f59e` (O2b): this file's Record only.
- No code file conflicted in any merge.

**Changelogs, checked as one set.** `editor/CHANGELOG.md` and `export/CHANGELOG.md` each have
exactly one `[Unreleased]`, directly above `[0.9.4]`: editor **8** bullets (O4 2, O3 3, O6-A 1,
O6-B 1, O2 1), export **9** (O3 1, O1 5, O2 2, O2b 1). Export's released part (`[0.9.4]` down) is
byte-identical to the 0.9.4 cut `ee9d41fa`. The editor's differs by exactly two link targets in
older released bullets (`DEPLOY_DOCKER.md` / `DEPLOY_CLOUDFLARE.md` → PUBLISH.md anchors, words
unchanged: O6 review Q1, `ef84f535`). `homepage/CHANGELOG.md` keeps its own convention (one
`[Unreleased]`, no cuts) and gained O2's four bullets, O2b's icon bullet and O6-B's Docker-page
bullet; O6-B's rename also rewrote one release-10 bullet there (`HOMEPAGE_SUMMARY_FILE` →
`E2E_HOMEPAGE_SUMMARY_FILE` beside `e2e/fixture-accents.ts`, a file that no longer exists — found
and left, below). No bullet repeats or contradicts another or the code as merged.

**Gates**, all from the worktree root on `eb28a341` (`$T/int-gates.log`, `$T/int-e2e.log`, per-run
logs `int-g-*.log` / `int-e2e-*.log`).
- **tsc** (`pnpm -r --no-bail --workspace-concurrency=1 exec tsc --noEmit`): clean, 67 s.
- **Unit and script tests:**
  - common **2,112/2,112**, 45 s (O6-B's recorded count: release 10's 2,038 + O4 3 + O3 10 + O6 30 +
    O1 21 + O2 5 + O2b 3 + O6-B 2);
  - editor unit **85/85**;
  - `test:scripts` **185 passed + 1 skip of 186** (the report-to-video tests included, O5's +10; the
    skip is the `LIVE=1` network test);
  - mcp **269/269**; homepage unit **2/2**.
  - `archilyzer docs env --check`, `settings example --check`, `docs files --check`: all exit 0.
- **Builds**, all ok, with `export/public` linked per path from the primary (17 links, none dangling)
  and `homepage/public` holding only its tracked `_headers` (no data copied):
  - editor 35 s (`BUILD_ID` `dcjZIUK_AhSRInyprrQny`); the route table lists
    `/api/ops/build-homepage`, `/api/ops/deploy-homepage` and `/api/ops/cut-release`;
  - export site 23 s: `<html … data-accent="signal">`;
  - export hub (`INSTANCE_MODE=hub`) 23 s: `… dark" data-base="dark" data-accent="signal"`,
    `out/ask/index.html` present (48,656 B);
  - homepage (`pnpm --filter homepage exec next build`, NOT `run build`, whose `prebuild` indexes the
    corpus) 12 s: the no-data page; its stylesheet carries the `forced-colors` rule and `--chart-6`
    (×2 `#823c10`, ×1 `#a54a08`);
  - umtool 16 s (`BUILD_ID` `pikb-0UeTC_FTcwMV-Xml`).
- **e2e**, one detached sequence (04:44 → 05:38), every run through the machine-wide queue (no
  wait: nothing else held it):

  | suite | passed | failed | skipped | time |
  |---|---|---|---|---|
  | export full | **206** | 0 | 0 | 6.9 min |
  | `e2e:hub` | **33** | 0 | 0 | 1.2 min |
  | `e2e:2origin` (`E2E_TWO_ORIGIN_REBUILD=1`, links in place) | **3** | 0 | 0 | 34.2 s (64 s with the two hub builds) |
  | homepage full (no `homepage/public` data) | **31** | 0 | **0** | 45.5 s |
  | umtool full (`SONG_DIR=~/reports/quartering-uh-song/data`) | **175** | 2 | 45 | 4.2 min |
  | **editor full** (`pnpm e2e`, 665 tests) | **652** | 1 | 12 | 39.5 min |

  The homepage's 31 with 0 skipped is O2's claim proved on a clean worktree: the suite reads its
  synthetic summary and nothing from `public/` or the primary (`e2e/.e2e-summary.json` written by the
  config; `homepage/public` still only `_headers` after). The 45 umtool skips are the song-data
  capabilities this machine lacks (O5's and O6-B's runs: the same 175 / 2 / 45). `e2e:2origin`'s log
  shows `compose hub` run twice (N1) into the WORKTREE's `export/public`.
- **Failures, classified** (each re-run alone, `$T/int-rerun*.log`):
  - **umtool `mix.spec.ts:166` and `:201`: the known order-dependent pair, not the integration.**
    Failed exactly as FACTS records ("`mix.spec.ts` IS ORDER-DEPENDENT"): the row linked to the
    fixture's `channels/testchan/data/vid1/clips/0.00-14.00.mp4`, left by an earlier spec, instead of
    `/out/clips-raw/vid1_0.00-9.00.mp4`. O5's and O6-B's full runs failed on the same pair. Alone,
    `mix.spec.ts --repeat-each=3`: **36 passed**, 36.4 s (`int-rerun-umtool-mix.log`).
  - **editor `transcript-source.spec.ts:76` ("diagnostics list a video with only
    transcript.en-US.vtt"): a flake, not known before this pass.** The Diagnostics stage rendered
    "Channel health" with no populated bucket, so the snapshot the page read lacked the video in
    `nonStandardVtt`; the `Non-standard transcript VTT name (1)` heading never appeared (5 s
    expect, 17.5 s in all). Alone, `transcript-source.spec.ts --repeat-each=3`: **9 passed** (the
    spec's three tests ×3), 41.6 s (`int-rerun-editor-transcript-source.log`). Release 11 touched
    nothing on its path: not the spec, `e2e/helpers.ts`, `common/controller/channelSnapshot.ts`,
    `common/views/pipeline/stageStatus.ts`, `DiagnosticsStage.tsx` or the channel `page.tsx` (`git
    diff --stat 2162db92 eb28a341`). O3's `RetryBucketControl` change renders inside a bucket's card,
    below the heading that went missing, so it cannot hide it. The likeliest mechanism is
    `generateReport`'s early return when a `snapshot.json` already exists (`e2e/helpers.ts:193`):
    one written between `resetData` and the test's VTT swap (a debounced flush from the test before)
    would be stale and never refreshed. Recorded in FACTS; not fixed (no code at integration).
  - Nothing else failed. The 12 editor skips are `channels-rack-audit.spec.ts`, which runs only with
    `E2E_RACK_SHOTS=1`.
  - **Verdict: FLAKES-ONLY.** No regression.
- **The primary's `export/public` was never written.** `$T/int-ptree.sh` lists every entry (391:
  380 files, by path, type, size, mtime and md5; links by target — it has none) without following
  links. Taken before any build (`int-primary-before.tree`, md5 `0f4b1f66…`), after the builds,
  after the export suite, after `e2e:hub`, after `e2e:2origin` and after the editor suite:
  **identical every time** (`cmp`).
  - What the runs did in the worktree: the export suite replaced the `sw.js` LINK with its own plain
    file; `e2e:2origin`'s `compose hub` (which logged "hub-summary.json skipped") replaced the `sw.js`,
    `hub-sites.json`, `corpus.json`, `llms.txt`, `robots.txt` and `_headers` links with plain files.
    The seed (`$T/int-seed-public.sh`) relinked every entry before the next run, and
    `find export/public -xtype l` was empty before each.
- **The live processes were never touched:** :3001 still serves `BUILD_ID` `S07zTu3MKTjHJa9eDM1GF`
  (2026-09-26 21:46); nothing was deployed, cut, pushed, restarted or written under `transcripts/`.
- Numbers tools: none.

**Records folded in at integration** (the `plans:` commits below).
- **FACTS:** a new section, "Release 11 — slices O1–O6", anchored at `eb28a341`. Amended with dated
  notes: the `/api/test/*` guard's variable (`EDITOR_TEST_ROUTES` → `E2E_TEST_ROUTES`, now set by
  `editor/playwright.config.ts`' `E2E_SERVER_ENV`, not `dev:test`), `TWO_ORIGIN_REBUILD` →
  `E2E_TWO_ORIGIN_REBUILD` in the two worktree-link facts, and `DEPLOY_CLOUDFLARE.md` →
  `PUBLISH.md` in the preview-access fact. Release 10's "L1 — hub lows" was already amended by O1
  (`ac9c299b`); its colour entry gains one dated line (`fittedHex` is `perBaseColor`'s only
  production caller). A closing subsection, "What the integration gate found", records the
  `transcript-source.spec.ts:76` flake and what each suite writes into a worktree's
  `export/public`.
- **O5 review's two wording lows (L1, L2) are recorded in FACTS, not fixed**: IBM Plex Sans has
  positive kerning pairs, so the sum of advances is not conservative in general (real text's worst
  net kerning +0.50 px); `FALLBACK_EM` 1.3 is exceeded by a few wide symbols (`⟹` 1.42 em). The
  comment at `umtool/report-to-video/svg-faces.mjs:32-35` and the README's "Why a table" still say
  otherwise — a comment-only fix for a later slice (no code changes at integration).
- **STATE:** a new "Now (2026-09-28, morning)" block above the 0.9.4 one. The 2026-09-26 block's
  "New lows (not started)" (the x.com icon through umtool's fonts, formerly l.142–155) and the
  2026-09-27 rollout's two new lows get a dated note: all closed, with the slice that closed each.
- **`brand-and-themes.md`:** S4's record said the rail/ledger/chart text stays Fira and no bold Plex
  Mono is vendored (the "Not branded, on purpose" bullet, the found-and-left `fontBold` bullet and
  the review-rulings line); each gets a dated note that O5 closed it.

**Found during the pass.**
- **One `homepage/CHANGELOG.md` bullet is now wrong about its own past.** O6-B's rename rewrote the
  release-10 bullet "The e2e reads a copy of the summary with fixture accents (`HOMEPAGE_SUMMARY_FILE`,
  `e2e/fixture-accents.ts`)" to `E2E_HOMEPAGE_SUMMARY_FILE`; neither the new name nor the file
  existed at that time, and the newer O2 bullet already says the fixture file is gone. Harmless:
  `homepage/CHANGELOG.md` is not published (the homepage's `/changelog` renders export's,
  `homepage/app/changelog/page.tsx:25`). A wording fix at the next touch.
- **The O1 review's new low (a `<clipPath>` counted as a colour) was folded into O2b** (`c17ead28`),
  so nothing from it is open.
- **Merged code already runs where processes spawn scripts from disk.** The primary checkout is on
  `main` `eb28a341`, so the live :3050 already spawns O5's `umtool/report-to-video/*` (a branded
  render gets Plex and the bold mono; an unbranded one is byte-identical), and any build the live
  :3001 starts runs the new on-disk scripts (release 7's lesson). O6 kept every package-script name
  the publish pipeline calls (`build:index`, `compose:site`, …), so an old-editor build still
  resolves them; an unattended build-deploy would publish the merged code with its `[Unreleased]`
  notes, which the operator accepted for the night. Outside `report-to-video/` and its e2e, umtool
  changed only in `lib/tools.mjs` (O6's shared probe) and two test-only variable names
  (`bin/cut-from-cache.mjs`, `lib/projects/kinds.mjs`); nothing requires a rebuild.

| sha | what |
|---|---|
| `eeff74c3` | `plans:` FACTS — release 11 section; dated amendments (the `E2E_` names, PUBLISH.md) |
| `3643c974` | `plans:` `brand-and-themes.md` — O5 closed S4's Fira and bold-mono notes |
| _this_ | `plans:` this record, STATE ("Now (2026-09-28, morning)"), the Rollout steps |

### Operator rulings and follow-up O1c (2026-09-28 morning)

**The operator's words:** "Accept the rust, Vermilion keeps slot 6, ship the drafts as written but I
don't like this regex bracket link thing, just put it in the string or use a template literal or
something."

**The rulings:**
- **The four copy lines ship as written.** The three DRAFT markers are removed, and the words are
  unchanged:
  - `NO_ARCHIVES_IN_SCOPE` (release 10's): "No archives selected. Choose some on the hub's front
    page to ask.";
  - `NO_ARCHIVES_ON_HUB`: "This hub has no archives yet. Add one on the hub's front page to ask.";
  - `LIVE_CHAT_MISSING`: "live chat didn't load";
  - `ASK_SCOPE_LINE`: "Searching N of M archive(s) — change on the front page." It is shown whenever
    at least one archive is in scope.
- **`--chart-6`'s rust near `--state-gone` is accepted** (O2's question).
- **Vermilion keeps slot 6** (`ACCENT_CHART_SLOT.vermilion = 5`, the runbook's question).
- **Still open** at the time: O6's Build all vs `buildPipeline.mode`, and O3's full check of the
  five 410'd Rumble videos. *Both closed later that morning: the mode dropped (follow-up O6c) and
  the full check run ("Operator actions (2026-09-28 morning)").*

**O1c: the link is written in the line** (`a4ffa959`). Branch `r11/hub-lows`, fast-forwarded to
`main` `e1cedf3d` first.
- **What replaced the regex.** Each line is a tagged template:
  `` copy`No archives selected. Choose some on the ${link("hub's front page")} to ask.` ``.
  - `copy` returns a `Copy`: `{before, link?, after, text}`.
  - Plain interpolations (numbers, strings, brackets) are text. Only a `link(…)` value (a
    `CopyLink`) becomes the link to `/`, so nothing is parsed out of the words.
  - Two links in one line throw where the line is built: at module load for the constants.
    `ASK_SCOPE_LINE` is evaluated once at load for the same reason.
- **What was deleted:** `copyWithLink`, `copyText` and the regex.
- **Where a `Copy` goes:**
  - `LinkedCopy` takes a `Copy`. `AskChat` and `AskScope` pass the values through unchanged, and
    `ASK_SCOPE_LINE` returns `Copy | null`.
  - The hub specs (`ask.spec.ts`, `federated-search.spec.ts`) read `.text` / `.link`.
- **How to edit a line** is in `hubScopeCopy.ts`'s header: change the words; wrap the linked phrase
  in `${link("…")}`, or drop the wrapper for no link; `ASK_SCOPE_LINE` may return `null` to hide the
  line.
- **Rendered output is unchanged, byte for byte.** `LinkedCopy` still renders `before`, one
  `<Link href="/">` with the same classes, then `after`. `o1c-same.log` compares the old regex
  split and the old `copyText` with the new values for both constants and `ASK_SCOPE_LINE` at
  (0,1), (1,1), (1,2), (2,5) and (5,5): all identical, and `LIVE_CHAT_MISSING` is the same string.
- **Why:** the operator's ruling. A reader-facing line should not depend on a bracket convention and
  a regex, and any `[…]` pair in future copy would have been read as a link.
- No changelog bullet: nothing a reader sees changed.

| sha | what |
|---|---|
| `a4ffa959` | `hub:` `copy` / `link()` / `Copy` replace the [bracket] + regex; the four lines as ruled, DRAFT markers gone; `LinkedCopy` takes a `Copy`; the specs read `.text` / `.link`; +4 unit tests |
| _this_ | `plans:` the rulings here, in O2's and O1's records, FACTS and STATE; Rollout step 1 |

**Gates** (logs `o1c-*.log`; the e2e logs are `o1-e2e-{hub,export}-3.log`):
- **tsc:** clean (`o1c-tsc-1.log`, 82 s).
- **Unit and script tests** (`o1c-units.log`): common **2,112/2,112**, editor unit **85**, `test:scripts`
  **185 + 1 skipped**, mcp **269**.
- **The new unit test:** `export/app/ask/hubScopeCopy.test.ts` **4/4** (run with export's tsx; no
  suite script runs `export/app/**/*.test.ts`).
- **e2e** (`o1c-run.log`):
  - `e2e:hub` in full: **33 passed**, 1.8 min;
  - export `ask-chat` + `ask-workspace`: **29 passed**, 1.4 min.
  - The primary's `export/public` was unchanged: 380 files, size + mtime + md5.

**It bites** (`o1c-bite.log`):
- **Against the old `hubScopeCopy.ts`:** **4 of 4 fail**. There is no `copy`/`link`, and the
  shipped lines are strings with no `.text`.
- **A mutation, a second link not throwing:** exactly the two-links test fails.

### Follow-up O6c — the build-mode stub dropped (2026-09-28 morning)

**The ruling.** The operator: "If docker build mode isn't ready yet, just drop it for now rather
than keep the stub." `buildPipeline.mode` was a label nothing read (O6's review S2). Build all and
Build & deploy all use containers whenever `docker version` answers, and build serially on the host
otherwise. That is unchanged. Branch `r11/phase-4-s3`, fast-forwarded to `main` `27723d37` first.

**What went:**
- `common/lib/settingsSchema.ts`: the `mode` key, `BuildMode` and `isBuildMode`, and `mode`'s
  field doc. The buildPipeline description and the `maxParallelBuilds` doc no longer name a mode.
  `SETTINGS.md` and `settings.json.example` are regenerated.
- The `/sites` Basic | Docker toggle: `BuildModeToggle.tsx`, `buildModeAction.ts`, and its use and
  `getSettings` import on `/sites`.
- The Settings form's select (and "(Docker mode)" in the Max parallel builds label) and
  `settings/actions.ts`' handling of it.
- The publish tab's "Build mode (Basic or Docker) is set on the Sites page" line.
- The mode's mentions in:
  - `BuildAllSitesButton` (comment and paragraph) and `BuildSitesPanel` (comment and note);
  - the `buildAction.ts`, `publish/build.ts:378` and `Dockerfile.build:1` comments;
  - `PUBLISH.md`, `RUNNING_IN_DOCKER.md:~545` and the homepage's `deploy-docker.md`.
- Specs:
  - `deploy-page.spec`'s toggle test is now "/sites has no build-mode toggle, and Build all says
    when it uses containers";
  - `settings.spec` saves the three real fields and asserts no Build mode control and no `mode`
    on disk.

**What stays:** the container path, `maxParallelBuilds`, `dockerImage` and `dockerfile`.

**An old file still loads.** The operator's `settings.json` says `"mode": "basic"`.
`sanitizeBuildPipeline` builds its output from the three real fields only, so that file loads with
no error, and the next save writes no `mode`.
- `settingsSchema.test.ts`: the sanitizer and the whole-file parse drop `mode`, for `"basic"`,
  `"docker"`, junk and a number.
- `settingsWrite.test.ts`: a file carrying `mode` loads through `getSettings()`, and
  `writeSettings` puts exactly `{maxParallelBuilds, dockerImage, dockerfile}` on disk.
- `settings example --check` compares the committed `settings.json.example` and `SETTINGS.md`
  against what the schema generates. Both are regenerated without `mode`, so it exits 0.
- It never reads the operator's file.

**Changelogs.** The O6 editor `[Unreleased]` bullet that said "the mode is a label" is replaced,
not stacked. It now says the toggle and setting are gone, an old file loads, and Build all uses
containers when it can, as it always did. The O6-A bullet's build-mode sentence is removed. The
homepage bullet for its Docker page says there is nothing to switch on.

| sha | what |
|---|---|
| `5b6a66ec` | `editor, common:` the stub dropped (schema, toggle, select, copy, the two specs, two new settings tests) |
| `7262256f` | `docs:` PUBLISH, RUNNING_IN_DOCKER, the homepage's Docker page |
| _this_ | `plans:` this record, STATE, FACTS amendments; the editor and homepage changelog bullets replaced |

**Gates**, from the worktree root on `27723d37` + these commits (`$T/o6c-*.log`):
- tsc clean (70 s).
- **common 2,114/2,114** (+2), **editor unit 85/85**, **`test:scripts` 185 + 1 skip**, **mcp
  269/269**.
- The three `--check`s: all exit 0.
- `next build`: editor ok (39 s), homepage ok (15 s).
- **e2e** (`o6c-specs.txt`: deploy-page, settings, sites-crud, sites-homepage, ops-api): **56 passed, 0
  failed, 2.2 min**.
- **They bite:** with `27723d37`'s `settingsSchema.ts` under the new tests, both new tests fail
  (22 pass, 2 fail — `o6-bite.log`).

**Operator actions (2026-09-28 morning).**
- **The five 410'd Rumble videos are settled.** On the operator's word ("full check the rumble
  channels"), the parent ran **Full-check unexpected** on the live :3001 at **2026-09-28 13:32Z**,
  through the editor's `platform:rumble` queue at concurrency 1 (`$T/fc-run.log` has the job ids; the
  per-video verdicts are the job logs, `transcripts/.jobs/<id>*.log`):
  - `rekietalaw-rumble`, job `01M3M3EVM0M3EZH9ETK6KY1AH7`: `v7e07us` deleted. `v7emb9a` was NOT
    probed: "Skip v7emb9a: no webpage_url in metadata.info.json". Its dir holds only a failed
    download from 2026-08-26 (`availability.json` `error`, source `download`), so it stays "Missing?"
    as it already was: it was never one of O3's five, and no check can settle it without a URL;
  - `the-quartering-rumble`, job `01M3M3F55A7VESDMYTM5801YJK`: `v4vriou`, `v4x5o1l`, `v4yqask` and
    `v501kfc` deleted;
  - 0 errors.
- So O3's five read **Deleted** at the next index build, not "Missing?". Jeralyzer's and
  Rekietalyzer's "Missing?" counts do not rise by 4 and 1.

## Rollout

Nothing is rolled out: no cut, no deploy and no restart happened overnight, by rule. `main` is the
integration tip (above); the live :3001 editor still runs `BUILD_ID` `S07zTu3MKTjHJa9eDM1GF`
(2026-09-26 21:46), and the live sites are 0.9.4. The operator owes, in order (the parent's runbook,
`~/reports/overnight-2026-09-28/MORNING.html`, has the scripts):

1. ~~**Rule on the copy lines**~~ **Ruled 2026-09-28: the four lines ship as written** ("Operator
   rulings and follow-up O1c", above). The drafts' markers are gone and each link is written in its
   line (`` copy`…${link("…")}…` ``); no commit is owed for them before the cut.
2. **Answer the records' questions** (none blocks the rollout):
   - ~~O6: should Build all / Build & deploy all honour `buildPipeline.mode`?~~ **Ruled 2026-09-28:
     dropped.** Follow-up O6c removed the mode, the `/sites` toggle and the Settings select;
     containers are used whenever `docker version` answers, as before.
   - ~~O2: is `--chart-6`'s rust acceptable beside `--state-gone`?~~ **Ruled 2026-09-28: accepted;
     Vermilion keeps slot 6.**
   - ~~O3: settle the five Rumble videos that got HTTP 410 on 2026-09-25 with a "Full-check
     unexpected" on `rekietalaw-rumble` and `the-quartering-rumble`.~~ **Done 2026-09-28 13:32Z:**
     all five read deleted, 0 errors ("Operator actions (2026-09-28 morning)"); they publish as
     Deleted at the next build.
3. **Cut the release:** `archilyzer release show`, then `archilyzer release cut all next --commit`
   (editor 8 pending bullets, export 9; export's are public on every site's `/changelog`). The
   homepage changelog keeps its own `[Unreleased]` convention and is not cut.
4. **Restart :3001 on the new `main`** (one restart). It brings O4's Homepage section and the two ops
   routes, O3's retry-bucket, forced-download and Cut release form fixes, O6c's removal of the
   build-mode toggle and select, O6's digest replay that keeps `ids`, and O2's sidebar outline under forced colours. **Restart before
   retrying any `archilyzer run digest` job**: the old editor's replay widens it to the whole channel.
5. **Write the settings once** (any Save on Settings, or any other settings write). `writeSettings`
   re-normalizes every stored social link, so the x.com icon's `fill="white"` becomes `currentColor`.
   Check `settings.json` afterwards.
6. **Deploy.** First the five sites by name: the maybe-missing badge change, the forced-colours
   outline, the single-colour icon and the changelog. Then the hub: O1's `/ask` changes, the fitted
   hex for official and added archives, the outline. Then the homepage, **through the new `/sites` →
   Homepage section**: Build homepage with Deploy after build unticked, then Deploy homepage (or `pnpm
   ops build-homepage --wait`, then `pnpm ops deploy-homepage --wait`; the log ends `[deployed]
   https://<hash>.archilyzer.pages.dev`). That is O4's live proof. The homepage reads the index as it
   stands, so it goes after the sites' builds.
7. **Re-upload the YouTube picture, watermark and banner** (`~/reports/archilyzer-media/brand/`),
   still owed since release 10.
8. **Optional:** rebuild and restart umtool on :3050. Nothing in the app needs it; O5's render changes
   already reach the live :3050 from disk, and an unbranded render is byte-identical.
9. **Afterwards:** remove the seven merged `r11-*` worktrees when nothing runs (it re-sorts the port
   blocks; `diet-series` stays).

## Rollout, as done (2026-09-28, 12:11–14:05 local)

Run by the parent from the primary checkout with the scripts in
`~/reports/overnight-2026-09-28/scripts/`, on the operator's plan of 2026-09-28 (roll out release 11
as 0.10.0 and launch Jasolyzer, exports off). Logs: `~/reports/overnight-2026-09-28/tmp/r11-*`.

1. **Cut** (`archilyzer release cut all next-minor --commit`): editor **0.10.0** `24c8352e` (8
   bullets), export **0.10.0** `bf6904e8` (9). The homepage changelog keeps its own convention.
2. **The external drive stalled first.** From 11:35 the auto-download lane's remux of a 10.3 GB
   `nuxanor-kick` VOD, reading and writing the same SMR disk (Seagate ST2000DM008 in a JMicron
   JMS578 UAS enclosure, `sdb`), drove it into 30 s command timeouts, UAS aborts and USB resets
   (`hostbyte=DID_ERROR cmd_age=30s`; the `I/O error` lines are failfast READAHEAD requests; no
   medium errors, no ext4 errors). All four of the live editor's libuv threadpool workers blocked in
   ext4 reads on it, so **:3001 answered nothing** (not even `/api/view/pulse`) from ~12:10 until
   the remux finished at 12:56:39. Every one of the six sites has a channel on that drive (11
   channels), so the rollout waited. The operator checked the cable and ran `smartctl` (the identify
   command failed: the drive was busy). Nothing was killed. Found and left, for a later slice: one
   stalled drive freezes the whole editor.
3. **:3001 restart** on `main` `e6c5d2e3` (the cut + release 12's slice Q, whose editor-side changes
   are comments and an `[Unreleased]` bullet): `r11-build.sh` BUILD_OK 97 s, `BUILD_ID`
   `S07zTu3MKTjHJa9eDM1GF` → `vWCJb87ktCy5akih_pM9X`; `r11-restart.sh` `/` 200 after 3 s, `/sites`
   has the Homepage section, 0 ZodError, boot `re-queued 0, cancelled 29 (sync 26, stale 3)`. The
   md5 sweep (81 files: settings, every `site.json` and `config.json`, `homepage.json`) was identical
   before, before the restart and after boot. `smoke.sh`: 20 OK lines, `PULSE_OK` ×2,
   `DEFERRED_OK`, umtool OK; `SMOKE_FAIL=1` from one `PAIR_DIFF`
   (`/api/auto-queue/status` vs `/api/view/autoQueueStatus`, 10 bytes of 517 KB, the two calls 98 s
   apart) that is live drift — a `hasanabi` pick and a `HasanAbiVODs3` queue between the calls.
   The OOM killer fired at 13:01:11 on the OLD editor (already exiting under TERM, anon-rss 0) and a
   worktree e2e server; the new editor was unaffected.
4. **One Settings save** (headless, no change): `buildPipeline.mode` is gone and the x.com icon's
   `fill="white"` is `currentColor`. Two saves ran — the first script's wait resolved on Next's
   empty route-announcer alert and closed early, but its save still landed (13:06:01); the second
   rewrote byte-identical JSON. md5: only `settings.json` changed.
5. **Jasolyzer:** Pages project `jasolyzer` created (`wrangler pages project create jasolyzer
   --production-branch main`); `/sites/jasolyzer` saved headless with `cloudflareProject`
   `jasolyzer`, `siteUrl` `https://jasolyzer.pages.dev`, archives off, transcript downloads off and
   the draft `siteDescription` "Search through the streams of our favorite game dev, Jason 'Pirate
   Software' Hall" (the operator may reword it). md5: only `transcripts/sites/jasolyzer/site.json`.
6. **Deploys** (`pnpm ops build-deploy --json '{"siteIds":[six],"skipArchives":true}'`, the host
   path, by name — `r11-sites6.sh`): SITES_OK in 2,872 s, no site skipped.

   | Site | Job | Deploy |
   |---|---|---|
   | jasolyzer (first deploy) | `01M3MFRJ9RVDYPERPY22C3MD49` | https://fa021d5b.jasolyzer.pages.dev |
   | jeralyzer | `01M3MFRJDSJV341S08JG0PV21E` | https://9bbd2c88.jeralyzer.pages.dev |
   | anilyzer | `01M3MFRJDZRQWW56APC4NQGVBC` | https://1a6a795d.anilyzer.pages.dev |
   | bonnellyzer | `01M3MFRJEF4K2GJSE0D06FBPYH` | https://bb5cb426.bonnellyzer.pages.dev |
   | hasanalyzer | `01M3MFRJEHZ53S9V6DDN9QVNX1` | https://2cd0d19f.hasanalyzer.pages.dev |
   | rekietalyzer | `01M3MFRJEVNHMNHKQ3KH8BEEZY` | https://1ca2acf8.rekietalyzer.pages.dev |
   | hub (`build-hub {"deploy":true}`) | `01M3MJG5DG0ZGH16VYWWKCT7QR` | https://c215ae89.archilyzer-hub.pages.dev (84 s) |
   | homepage (`build-homepage {"deploy":true}` — **O4's live proof**) | `01M3MJK8NV8N1M3PPGQC6F3V0X` | https://41bef909.archilyzer.pages.dev (73 s) |

7. **Live checks, all pass:** every `/changelog` of the eight surfaces reads 0.10.0; the
   forced-colours rule is in every site and the hub; the x.com footer icon is `currentColor` (it
   follows the footer colour); Jasolyzer serves `data-accent="vermilion"`, a footer listing the
   five siblings and a `corpus.json` of 1 channel / 1,889 videos; `hub-summary.json` has 6
   instances; the homepage's summary has 6 sites and draws Jasolyzer on `var(--chart-6)` (legend and
   area); the five 410'd Rumble videos publish `isDeleted: true` (Jeralyzer `v4taj2f`, `v4uooni`,
   `v4we0zh`, `v4xpb46` — URL slugs `v4vriou`, `v4x5o1l`, `v4yqask`, `v501kfc`; Rekietalyzer
   `v7btopk` — slug `v7e07us`).
8. **Closed as moot:** the Legal Mindset chat-only tier (its filter has `includeLivestreams: true`,
   so the tier never changes what is kept).
9. **Still owed:** re-upload the YouTube picture, watermark and banner (since release 10); the
   seven `r11-*` worktrees stay until release 12's worktrees are gone (index-based ports).