Only the browser seat runs browsers, and only inside internal/browser-slot.sh.
That rule was remembered, not enforced: an agent ran a gate it took for a
headless source check and it launched Chromium outside the slot.
internal/lib/playwright-guarded.mjs is now the one way a repo file reaches
playwright: its launch(), launchPersistentContext(), launchServer(), connect()
and connectOverCDP() exit 75 (NOT MEASURED) with a message naming
browser-slot.sh unless DOXA_BROWSER_SLOT is set, and browser-slot.sh exports it
for the command it runs, so a bash -c grandchild inherits it. All 72 files that
imported playwright switch to it (internal/lib/browser.mjs and 64 internal gates;
plugin-designs scripts: doxa-research-map 3, my-upg-100-list 2,
research-map-plus-grid 2, research-dashboard 1): a mechanical import swap.
check:browser-gates-guarded (gates:pre) fails a direct import;
bun run browser-gates lists the 97 scripts that launch a browser. isBrowserGate
moves to internal/lib/browser-gates.mjs so the runner and the check share it.
The output tree's name has always been configurable (vite.doxa-maps-build-config.json "name"),
but 61 tooling files ignored it and hardcoded 'doxa-maps' (181 literals), so a rename would have
moved the build while the gates kept reading the old folder.
- internal/_tree-name.mjs reads it once (validated as one URL-safe path segment; falls back to the
historical name) and exports TREE_NAME / TREE_NAME_RE; `node internal/_tree-name.mjs` prints it
for shell scripts.
- A codemod rewrote 171 literals in internal/ to TREE_NAME; the regex literals, messages with
backticks, atomic-public-swap.sh (fails loudly if the name cannot be read), build-lock.sh and
vite.config.js (its duplicate readMfeName is gone) were done by hand.
- The name is unchanged: old and new tooling produce all 1408 files under public/ byte for byte.
Code lines still naming the tree in internal/ + vite.config.js: 2, both intended (the helper's
fallback, the private-repo-name pattern in public-hygiene-check).
This renames nothing visible; the eventual rename becomes a one-line config change.
Checkpointing thirteen files of agent work that were sitting uncommitted while three
agents wrote to a live tree the Driver was watching through hot reload. Uncommitted work
is work at risk, and a tree being edited under an observer oscillates between states that
look like regressions and are really just partial saves.
The second capability-5 shell now mounts its tabs as real elements too, so no iframe
remains in either shell. It was the last holdout: eight tabs, all iframe mode, each
pointing at a hardcoded built-tree leaf that does not exist under the dev server.
The facet rail keeps its shape when a filter narrows it. Selecting one place took the
rail from sixty-six rows to twenty-one — forty-six rows deleted, none dimmed — so the row
a user was about to click vanished under the cursor, which is what "the buttons went
dead" actually was. Rows whose count falls to zero are now re-admitted at their original
slot and depth, dimmed and inert, which also restores the component's own promise to lose
nothing against the tree it replaced.
Expanding a branch and filtering by it are now separate, visible affordances: the whole
row filters, and expand is a real button with its own hit area and label. Rows that were
never clickable are unmistakably inert rather than silently ignored.
Three more facet axes reach the grid — affinity bloc, engagement status and primary
language — each verified to share a field with an existing prop rather than being mapped
on name resemblance. Two derived facets remain unmapped on purpose: they have no matching
row field, and mapping them would filter confidently to the wrong rows.
The figure came from a loop that sampled only the first 30 leaf pages of a
41-item set, then got repeated as if measured. An exhaustive grep over
public/doxa-maps gives 41. Fixed here and in the 5x5 spec.
A sampled count that lands in a hand-off doc reads as measured, because a
plausible number invites no scrutiny. Counts stated in docs should come from
an exhaustive query.
Two of smoke's failures were the gate reporting a product decision. The
assertions date from when the root page embedded a live preview. Measured:
public/index.html has four occurrences of "profile-config" and all four are
escaped snippet and glossary text -- the gallery is a capability-sorted
navigation catalog that links to bundles and embeds none.
No coverage is lost, which is the only reason this is safe. The
generated-profile block asserts the same two things against a real leaf page
picked from the manifest, and that surface passes. 21 built leaf pages mount
with a profile-config at load. The shell copies were duplicates aimed at the
one surface that by design satisfies neither. Both counts are still REPORTED
in the shell log line, so a behaviour change stays visible.
My carded recommendation was to re-aim these at plugin-studio. That was
wrong and I checked before acting on it: the cap-5 studio leaf has exactly
one [profile-config] element at load -- its own host -- and zero nested
elements or live iframes. It mounts panes on activation. A load-time
assertion cannot see behaviour that starts on a click.
Negative-tested, after two invalid attempts. Rewriting the bundle src to a
404 makes smoke FAIL exit 1 on "imported no bundle that registered its
element". The first two attempts produced a green PASS for bad reasons -- one
edit never wrote, and the other removed an attribute from a JS-created
element while a bare static one remained -- so the mutation is now asserted
to have landed (before=1, after=0) before the result is believed.
Standalone repo that builds embeddable JAMstack map bundles (web components),
composes them into a lazy-loaded SPA via layouts/, and optionally wraps a
Capacitor Android/iOS app — one build, choose your output/CDN. Diátaxis docs.
History reset to a single clean commit; no PII, IPs, or internal terms.
