From ba88ef7547d070e67337d24359bf184cde0b114f Mon Sep 17 00:00:00 2001
From: Hector Alvarez <alvarez.hectorm@outlook.com>
Date: Sun, 13 Sep 2026 16:25:32 -0500
Subject: [PATCH 1/7] chore(cline): initialize memory bank

---
 memory-bank/activeContext.md  | 32 ++++++++++++++++++++++
 memory-bank/productContext.md | 34 ++++++++++++++++++++++++
 memory-bank/progress.md       | 36 +++++++++++++++++++++++++
 memory-bank/projectbrief.md   | 41 ++++++++++++++++++++++++++++
 memory-bank/systemPatterns.md | 50 +++++++++++++++++++++++++++++++++++
 memory-bank/techContext.md    | 47 ++++++++++++++++++++++++++++++++
 6 files changed, 240 insertions(+)
 create mode 100644 memory-bank/activeContext.md
 create mode 100644 memory-bank/productContext.md
 create mode 100644 memory-bank/progress.md
 create mode 100644 memory-bank/projectbrief.md
 create mode 100644 memory-bank/systemPatterns.md
 create mode 100644 memory-bank/techContext.md

diff --git a/memory-bank/activeContext.md b/memory-bank/activeContext.md
new file mode 100644
index 0000000..91d35d2
--- /dev/null
+++ b/memory-bank/activeContext.md
@@ -0,0 +1,32 @@
+# Active Context
+
+Updated: 2026-09-13
+
+## Current focus
+
+**Repo housekeeping** on branch `chore/repo-housekeeping` (off `dev`):
+
+1. ✅ Initialize memory bank (this directory) — commit 1.
+2. README corrections (HK-1): drop `robots.txt` from `src/public/` tree (it's
+   build-time generated), note sitemap/robots generation, add alarm tests to
+   the tests tree, add `tasks/` to the repo-layout table.
+3. CI actions bump (HK-2): checkout@v7, setup-node@v7, setup-buildx@v4,
+   login@v4, build-push@v7, hadolint-action@v3.5.0 (majors verified 2026-09-13).
+4. Husky guard (HK-3): skip lint-staged when no staged file matches its globs
+   (silences "could not find staged files" on workflow/env-only commits).
+5. `tasks/` close-out: sprint.md reflects US-001 merged + deployed;
+   backlog HK items resolved.
+
+## Environment state
+
+- `dev` = `origin/dev` = `223d41f`; local `main` reset to `origin/main`
+  (`c7ecdca`, post-rebase-merge). Working tree clean.
+- US-001 deployed (Release #5 success); homepage may serve up to 2 h of edge
+  cache; `healthz` verified 200.
+
+## Next steps after housekeeping
+
+- Owner: production audio check (alarm tone) → US-001 fully Done.
+- Pick next epic: US-002 (recurring alarms) vs US-004 (multi-clock).
+- Decide HK-5 (nginx 1.27 re-pin) timing — Dockerfile + digest bump + local
+  `nginx -t`.
diff --git a/memory-bank/productContext.md b/memory-bank/productContext.md
new file mode 100644
index 0000000..ffcc05b
--- /dev/null
+++ b/memory-bank/productContext.md
@@ -0,0 +1,34 @@
+# Product Context
+
+## Why
+
+A personal productivity site: a clean, dark, always-visible clock for a wall
+screen or a spare tab, growing into timer and alarms so one page replaces
+several utilities. Hosted under the taylormadetech.net domain.
+
+## Problems it solves
+
+- No-install clock/timer/alarm with persistence (localStorage, no accounts).
+- Distraction-free: no ads, no login, no tracking; single static page.
+- Self-hosted learning vehicle for a production-grade deploy pipeline
+  (GHCR images, webhook deploys, Cloudflare Tunnel, edge caching).
+
+## How it should work
+
+- **Clock** — always ticking, 12-hour format with AM/PM, seconds shown,
+  timezone-aware, dev marker only in dev builds. Tab title mirrors the time.
+- **Timer** — manual duration entry + presets, start/pause/reset, survives
+  reload via `localStorage`, beep + visual overlay on completion.
+- **Alarms (US-001)** — create/name/enable/disable/delete multiple alarms,
+  one-shot firing with 9-minute snooze, ring overlay with Snooze/Dismiss,
+  keyboard dismissal (Esc/Enter), persisted across reloads.
+- **Limitation (documented in-panel)** — alarms/timer ring only while the tab
+  is open; background-tab throttling can delay rings up to ~1 minute. No
+  OS/browser notifications (out of scope per US-001).
+- **404 page** — served by the edge with a real 404 status; separate CSS file
+  because the CSP forbids inline styles.
+
+## UX notes
+
+- Dark theme, large digits, responsive; keyboard-friendly controls.
+- Persistence is per-browser; no server state at all (static app).
diff --git a/memory-bank/progress.md b/memory-bank/progress.md
new file mode 100644
index 0000000..c296477
--- /dev/null
+++ b/memory-bank/progress.md
@@ -0,0 +1,36 @@
+# Progress
+
+## Status
+
+US-001 (Multiple Alarms) is **deployed to production** (PR #13 merged
+2026-09-13 21:17Z; Release run #5 succeeded; `healthz` verified 200).
+Site is live at `clock.taylormadetech.net`.
+
+## What works
+
+- Clock (tick, title mirror, timezone), timer (presets, persistence, beep),
+  alarms (multi, snooze, persistence, ring overlay) — 135 unit tests green.
+- Full CI gate: prettier, eslint, typecheck, vitest+coverage, build,
+  `nginx -t` × 2, compose config × 2, hadolint × 4.
+- Automated deploys: `main` → GHCR → webhook → swap with auto-rollback.
+- Cloudflare edge caching of `index.html` (2 h Cache Rule; `/healthz`
+  uncacheable) per ADR 0006.
+
+## Remaining / known issues
+
+- Production audio QA: alarm tone not yet verified by a human (jsdom can't
+  test audio) — last open US-001 DoD item.
+- Edge-cached homepage can lag up to 2 h behind a deploy (expected; judge
+  freshness via `/healthz` or hashed assets).
+- CI actions pinned to Node-20-runtime majors (HK-2 — fix in progress).
+- `nginxinc/nginx-unprivileged:1.27-alpine` is an EOL mainline branch
+  (HK-5 candidate: re-pin to current stable + digest).
+- npm minor drift: eslint/prettier/lint-staged/TS patch bumps available;
+  vite 7+/vitest 5 majors deliberately deferred (not housekeeping).
+- Multi-clock scaffold (`clock-registry.ts`) unwired (backlog US-004).
+- FLIP helper duplicated in timer/alarm UI (backlog US-003).
+
+## Next epic decision (owner)
+
+US-002 recurring alarms vs US-004 multi-clock (US-004 wants US-003 item 1
+first). See `tasks/backlog.md` + `tasks/sprint.md`.
diff --git a/memory-bank/projectbrief.md b/memory-bank/projectbrief.md
new file mode 100644
index 0000000..4aa95c5
--- /dev/null
+++ b/memory-bank/projectbrief.md
@@ -0,0 +1,41 @@
+# Project Brief — Simple Clock
+
+A single-page digital clock website (clock + countdown timer + alarms) built
+with TypeScript and Vite, served from a hardened container stack behind
+Cloudflare Tunnel. Live at `clock.taylormadetech.net`.
+
+## Goals
+
+- Always-accurate time display, zero-friction UX (no accounts, no tracking).
+- Countdown timer with presets; multiple named alarms with snooze and
+  persistence (US-001, deployed 2026-09-13).
+- Fully automated, unattended production deploys (`main` → GHCR → webhook).
+- Small attack surface: unprivileged containers, no inbound ports, CSP without
+  `unsafe-inline`.
+
+## Structure (folder-per-artifact monorepo)
+
+- `web/` — Vite app, tests, both app container images
+- `nginx/` — edge reverse-proxy image (security headers, real client IP, `/healthz`)
+- `webhook/` — deploy webhook image (listens for release trigger, runs deploy)
+- `scripts/` — host-side helpers (deploy, tunnel bridge, bootstrap)
+- `tasks/` — backlog + sprint tracking
+- `docs/` — ADRs, runbooks, user stories
+
+## Constraints (see ADRs 0001–0006)
+
+- Both containers listen on 8080; host port mappings must target 8080.
+- Base images pinned by digest; bump tag + digest together, deliberately.
+- Production ingress is Cloudflare Tunnel only — dev and prod tunnels use
+  different tokens.
+- `sitemap.xml` / `robots.txt` are build-time generated from `VITE_SITE_URL`.
+- Edge caching: `index.html` cached via Cloudflare Cache Rule (origin
+  `cdn-cache-control` is ignored on the free plan); `/healthz` never cached.
+
+## Success criteria
+
+- `make check` green (lint + typecheck + tests) before any merge.
+- Deploys require no manual host work; rollback is automatic on failed health
+  check.
+- Alarms ring while the page is open (documented limitation: no background-tab
+  rings, no OS notifications).
diff --git a/memory-bank/systemPatterns.md b/memory-bank/systemPatterns.md
new file mode 100644
index 0000000..9bf573f
--- /dev/null
+++ b/memory-bank/systemPatterns.md
@@ -0,0 +1,50 @@
+# System Patterns
+
+## App architecture (feature-based, see README)
+
+- **Pure cores** (`features/*/*.core.ts`, `shared/time`, `shared/audio`): all
+  business logic, zero DOM deps, fully unit-tested. Pure functions over
+  explicit state (`computeClockTick`, timer/alarm state machines).
+- **UI layers** (`*.ui.ts`): query DOM, bind events, render from the core.
+- **Adapters** (`*.storage.ts`, `shared/audio/beep.ts`): isolate side effects
+  (`localStorage`, `AudioContext`); platform deps are injectable for mocking.
+- **Composition root** (`app/app.ts`): the ONLY place that knows page element
+  IDs; `main.ts` calls `bootstrap()`. `app/config.ts` holds build-time config
+  (mode, storage keys).
+- Features are consumed via barrels (`@/features/clock`), path alias `@/` →
+  `src/`. `shared/dom/query.ts` provides typed querySelector helpers.
+- Known duplication: FLIP panel-open helper duplicated between `timer.ui.ts`
+  and `alarm.ui.ts` (backlog US-003 item 1 → `shared/dom/`).
+- `features/clock/clock-registry.ts`: multi-clock scaffold, not wired (US-004).
+
+## Container / pipeline architecture
+
+- **web**: dev image (Vite HMR, source-mounted) and prod image (build →
+  static serve on nginx-unprivileged). **nginx** edge: security headers,
+  `/healthz`, real client IP. **webhook**: receives release POST, runs
+  `scripts/deploy.sh` against the host through the Docker socket.
+- CI (`.github/workflows/ci.yml`): prettier, eslint, typecheck, vitest with
+  coverage, build, `nginx -t` on both configs, `docker compose config` on both
+  stacks, hadolint on all four Dockerfiles.
+- Release (`release.yml`): on CI success on `main` → build/push GHCR images
+  (`latest` + `sha-<sha>`, provenance + SBOM) → POST to deploy webhook.
+- Git history: linear, rebase-merge only; PRs `dev` → `main`.
+
+## Conventions
+
+- Tests mirror `src/` one-to-one under `web/tests/unit/` (Vitest + jsdom);
+  behavior-documenting tests over DOM re-queries.
+- Prettier: tabs, single quotes, semicolons, width 80, trailing commas.
+  ESLint: `consistent-type-imports`, no unused vars (`_` prefix), `no-console`
+  (error/warn only).
+- Husky pre-commit: lint-staged on staged `web/` files. Never `--no-verify`.
+- Conventional commits, scoped; each commit builds and passes checks alone.
+
+## Security invariants
+
+- Edge CSP has no `unsafe-inline`; every page (incl. 404) links a CSS file.
+- Security headers live only in `nginx/nginx.conf`; the app container knows
+  nothing of the outside world.
+- `.env` / `.env.prod` are secrets — never edit, echo, or copy tokens between
+  dev and prod tunnels.
+- Prod deploys fire automatically on `main`; never run prod targets unasked.
diff --git a/memory-bank/techContext.md b/memory-bank/techContext.md
new file mode 100644
index 0000000..70cb55b
--- /dev/null
+++ b/memory-bank/techContext.md
@@ -0,0 +1,47 @@
+# Tech Context
+
+## Stack
+
+- **TypeScript** + **Vite 6** (vanilla DOM — no framework), Node ≥22
+  (`web/.nvmrc`: 22).
+- **Vitest 4 + jsdom** for tests; `@vitest/coverage-v8` for coverage.
+- ESLint (flat config, `web/eslint.config.js`), Prettier, husky + lint-staged.
+- Containers: `node:22-alpine`, `nginxinc/nginx-unprivileged:1.27-alpine`
+  (EOL mainline branch — see backlog HK-5), `golang:1.24-alpine`, `alpine:3.21`
+  — all digest-pinned (ADR 0005). Deployer: `github.com/adnanh/webhook`
+  pseudo-version pin.
+
+## Commands
+
+All npm commands run inside `web/`; make targets from the repo root.
+
+| Purpose | Command |
+| :--- | :--- |
+| Full quality gate (before declaring done) | `make check` (lint + typecheck + test) |
+| Dev stack up/down/health | `make dev-up` / `make dev-down` / `make dev-health` |
+| Fast host-only dev loop | `cd web && npm run dev` |
+| Format check (CI-enforced) | `cd web && npm run format:check` |
+| Coverage | `cd web && npm test -- --coverage` |
+| Production build | `cd web && npm run build` → `web/dist/` |
+
+CI-relevant changes (compose, Dockerfiles, `nginx.conf`) must be validated
+locally with the same checks CI runs (hadolint via `hadolint/hadolint` image,
+`nginx -t` via the nginx image, `docker compose config -q`).
+
+## Setup facts
+
+- Dev edge at `http://localhost:8100` (compose); opt-in dev tunnel with its
+  own token. Prod stack uses GHCR images + prod tunnel + webhook.
+- `VITE_SITE_URL` is the single source for canonical/OG URLs and the generated
+  `sitemap.xml` / `robots.txt` (see `web/vite.config.ts`). Unset → falls back
+  to `http://localhost:8100`.
+- Env files: `.env` (dev), `.env.prod` (prod secrets) — gitignored, never
+  edit/echo. `.env.sample` documents the variables.
+
+## Constraints
+
+- Both containers listen on 8080; host mappings must target 8080.
+- No `unsafe-inline` CSP (ADR 0002): no inline `<style>` or style attributes
+  anywhere, including generated pages.
+- Base images digest-pinned; update tag + digest together, deliberately.
+- Prod deploys are automatic on `main` — never trigger prod targets unasked.

From 03bdb009e2e873ce41200eef4e7d7a6a2ff37228 Mon Sep 17 00:00:00 2001
From: Hector Alvarez <alvarez.hectorm@outlook.com>
Date: Sun, 13 Sep 2026 16:26:29 -0500
Subject: [PATCH 2/7] docs(readme): correct public tree, tests tree, and repo
 layout

---
 README.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 17c7296..1aa525f 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,7 @@ One directory per buildable artifact:
 | `webhook/` | Deploy webhook image, hooks, and entrypoint          |
 | `scripts/` | Host-side helpers (deploy, tunnel bridge, bootstrap) |
 | `docs/`    | Architecture decision records and runbooks           |
+| `tasks/`   | Backlog and sprint tracking                          |
 
 The built app is served by **two** containers. `nginx/` is the edge: it owns the
 security headers, the real client IP, and `/healthz`. `web/` is a plain static
@@ -61,7 +62,6 @@ web/                                    # Application workspace
 │   │   └── dom/query.ts                # Typed querySelector helpers
 │   ├── public/                         # Copied verbatim to the build root
 │   │   ├── favicon.svg
-│   │   ├── robots.txt
 │   │   ├── 404.html                    # Served by nginx with a real 404 status
 │   │   └── 404.css                     # Separate file — the CSP forbids inline styles
 │   └── styles/
@@ -76,6 +76,7 @@ web/                                    # Application workspace
 ├── tests/
 │   └── unit/                           # Mirrors src/ one-to-one
 │       ├── features/alarm/alarm.core.test.ts
+│       ├── features/alarm/alarm.storage.test.ts
 │       ├── features/clock/clock.core.test.ts
 │       ├── features/timer/timer.core.test.ts
 │       └── shared/time/format.test.ts
@@ -83,6 +84,10 @@ web/                                    # Application workspace
 └── vite.config.ts
 ```
 
+`robots.txt` and `sitemap.xml` are **generated at build time** from
+`VITE_SITE_URL` (see [Deployment](#deployment)) — never hand-add them to
+`src/public/`.
+
 ## Architecture
 
 The codebase is organized **by feature**, with a shared primitives layer:

From 46ccdf52ffdd78d07026e53a5f283342e36482b5 Mon Sep 17 00:00:00 2001
From: Hector Alvarez <alvarez.hectorm@outlook.com>
Date: Sun, 13 Sep 2026 16:29:11 -0500
Subject: [PATCH 3/7] ci: bump actions off the deprecated Node 20 runtime

---
 .github/workflows/ci.yml      | 18 +++++++++---------
 .github/workflows/release.yml |  8 ++++----
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 36e422c..b9d48f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,10 +24,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version-file: web/.nvmrc
           cache: "npm"
@@ -57,7 +57,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Validate the app server config
         run: |
@@ -80,7 +80,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Validate the dev stack
         run: docker compose -f docker-compose.yml config -q
@@ -103,28 +103,28 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Lint the app images
-        uses: hadolint/hadolint-action@v3.1.0
+        uses: hadolint/hadolint-action@v3.5.0
         with:
           dockerfile: web/Dockerfile
           config: .hadolint.yaml
 
       - name: Lint the production app image
-        uses: hadolint/hadolint-action@v3.1.0
+        uses: hadolint/hadolint-action@v3.5.0
         with:
           dockerfile: web/Dockerfile.prod
           config: .hadolint.yaml
 
       - name: Lint the edge image
-        uses: hadolint/hadolint-action@v3.1.0
+        uses: hadolint/hadolint-action@v3.5.0
         with:
           dockerfile: nginx/Dockerfile
           config: .hadolint.yaml
 
       - name: Lint the webhook image
-        uses: hadolint/hadolint-action@v3.1.0
+        uses: hadolint/hadolint-action@v3.5.0
         with:
           dockerfile: webhook/Dockerfile
           config: .hadolint.yaml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d2819b2..018b040 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,22 +41,22 @@ jobs:
 
     steps:
       - name: Checkout the commit CI validated
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.context }}/${{ matrix.dockerfile }}

From 2ec5837428d848ce9cb676e3e17667d6389823ec Mon Sep 17 00:00:00 2001
From: Hector Alvarez <alvarez.hectorm@outlook.com>
Date: Sun, 13 Sep 2026 16:30:27 -0500
Subject: [PATCH 4/7] ci(husky): skip lint-staged when no staged web files
 match

---
 .husky/pre-commit | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.husky/pre-commit b/.husky/pre-commit
index 466cbf4..0ae4bb1 100644
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1 +1,7 @@
-cd web && npx lint-staged
+# lint-staged runs from web/ and its globs (web/package.json) only match
+# staged files under web/. Skip it entirely when the commit touches nothing
+# it can check — otherwise it prints a confusing "could not find any staged
+# files" warning on docs-, workflow-, or root-config-only commits.
+if git diff --cached --name-only --diff-filter=ACMR | grep -qE '^web/.*\.(ts|js|json|css|md)$'; then
+	cd web && npx lint-staged
+fi

From 64bed3f856ec920d503945e82b5030289b203b20 Mon Sep 17 00:00:00 2001
From: Hector Alvarez <alvarez.hectorm@outlook.com>
Date: Sun, 13 Sep 2026 16:31:37 -0500
Subject: [PATCH 5/7] docs(tasks): close out US-001 and record housekeeping
 state

---
 tasks/backlog.md | 20 +++++++++++-------
 tasks/sprint.md  | 55 +++++++++++++++++++++++++++---------------------
 2 files changed, 43 insertions(+), 32 deletions(-)

diff --git a/tasks/backlog.md b/tasks/backlog.md
index 7bcd252..41ac276 100644
--- a/tasks/backlog.md
+++ b/tasks/backlog.md
@@ -36,11 +36,15 @@ sized/sequenced by the SDM.
 
 ## Housekeeping (backlog, non-story)
 
-- HK-1: README lists `robots.txt`/`sitemap.xml` under `src/public/`; they are
-  build-time generated. One-line docs fix.
-- HK-2: Bump GitHub Actions pinned majors off the deprecated Node 20 runtime
-  (CI warnings observed; low urgency).
-- HK-3: lint-staged "could not find staged files" noise on docs-only commits —
-  verify web/package.json config matches repo-wide staging.
-- HK-4: Memory bank update — capture alarm feature patterns in
-  systemPatterns.md; prune activeContext.md.
+### HK-5 — Re-pin the nginx base image off the EOL 1.27 branch
+- Status: Candidate (found 2026-09-13 during the repo date/staleness audit).
+- Finding: `nginxinc/nginx-unprivileged:1.27-alpine` was last built
+  2025-06-23; the 1.27 mainline stopped shipping when 1.29 released, so the
+  edge and prod images run an unmaintained branch. The digest pin itself is
+  current for the tag — the staleness is at the version level.
+- Requires: choose the current nginx stable branch, bump tag + digest
+  together (ADR 0005) in `web/Dockerfile.prod` and `nginx/Dockerfile`, update
+  the image tag in `.github/workflows/ci.yml` (nginx-config-check), and run
+  `nginx -t` locally on both configs.
+- Priority: Medium — security updates are accruing on the EOL branch.
+
diff --git a/tasks/sprint.md b/tasks/sprint.md
index 532b42d..74303b9 100644
--- a/tasks/sprint.md
+++ b/tasks/sprint.md
@@ -2,40 +2,47 @@
 
 Sprint window: active (no fixed calendar sprint; pipeline-driven).
 
-## In flight
+## Completed (pending final QA)
 
 ### US-001 — Multiple Alarms (Epic: Alarms)
-- Status: **COMPLETE — awaiting release approval.**
-- PR #13 (`dev` → `main`): OPEN, MERGEABLE, all 8 CI checks SUCCESS.
-- Story DoD: implementation ✅, tests ✅ (135 passing), QA ✅, code review ✅.
-- Blocker: none technical. **Merge of PR #13 deploys to production
-  automatically** (Release workflow → webhook) — human approval gate, owned by
-  the project owner.
-- Post-merge tasks:
-  1. Verify `https://clock.taylormadetech.net/healthz` (live, `DYNAMIC` — do
-     not judge freshness by the cached homepage; up to 2h edge cache).
-  2. Manual browser check: alarm tone plays (visual overlay is verified;
-     audio cannot be verified in jsdom).
-  3. Story status → Done after production verification.
+- Status: **MERGED + DEPLOYED.** PR #13 merged 2026-09-13 21:17Z (linear
+  history, 9 commits).
+- Release run #5 succeeded 21:18Z; webhook deploy fired; `/healthz` verified
+  HTTP 200 post-deploy.
+- Remaining DoD: manual browser check that the alarm tone plays (audio cannot
+  be verified in jsdom) — owner task. Then story status → Done.
+- Note: the homepage may serve up to 2 h of edge cache (ADR 0006); judge
+  deploy freshness via `/healthz` or hashed assets, not the cached HTML.
+
+## In flight
+
+### Housekeeping branch `chore/repo-housekeeping` (→ PR into `dev`)
+- HK-1 README corrections, HK-2 Actions bump to Node-24 majors
+  (checkout@v7, setup-node@v7, buildx@v4, login@v4, build-push@v7,
+  hadolint-action@v3.5.0), HK-3 husky lint-staged guard, HK-4 memory bank
+  init, plus US-001 sprint close-out (this file).
+- All committed on the branch; local `main` reset to `origin/main` after the
+  rebase-merge rewrote SHAs.
 
 ## Ready (not started)
 
-Nothing yet — next sprint content comes from the backlog once US-001 closes
-and the owner picks the next epic (Alarms follow-ups vs. Multi-clock).
+Nothing. Next sprint content comes from the backlog once the owner picks the
+next epic: US-002 (recurring alarms) vs US-004 (multi-clock).
 
 ## Dependencies & sequencing
 
-- US-002 (recurring alarms) depends only on US-001 merge — can start any time
-  after, even against `dev` before `main` moves.
-- US-003 (review follow-ups) is independent; best bundled with US-002 or US-004.
-- US-004 (multi-clock) should wait for US-003 item 1 (shared FLIP helper) and
-  needs PO + possibly an ADR.
+- US-002 can start any time — builds directly on the alarm core.
+- US-003 (review follow-ups) is independent; best bundled with US-002 or
+  US-004.
+- US-004 should wait for US-003 item 1 (shared FLIP helper) and needs a PO
+  story + possibly an ADR.
+- HK-5 (nginx 1.27 re-pin, see backlog) is independent of the epics.
 
 ## Risks
 
 | Risk | Likelihood | Impact | Mitigation |
 |---|---|---|---|
-| PR #13 merge forgotten; work silently stalls | Medium | High (pipeline blocked) | This sprint file; owner decides merge timing explicitly |
-| Two unrelated `chore(cline)` commits ride in PR #13 | Low | Low (cosmetic history) | Owner may strip before merge if desired |
-| Background-tab throttling delays rings up to ~1 min | By design | Low | Documented in-panel; matches story's stated limitation |
-| CI action-runtime deprecation warnings accumulate | Low | Medium later | HK-2 on backlog |
+| Production alarm audio unverified | Medium | Medium (US-001 DoD gap) | Owner manual check; tracked above |
+| nginx 1.27 base gets no security updates (EOL mainline) | High | Medium | HK-5: re-pin to current stable |
+| Edge cache hides new deploys for up to 2 h | By design | Low | Judge freshness via `/healthz` |
+

From 2700c9dceef84d2b425a27c1dac99fb99f171405 Mon Sep 17 00:00:00 2001
From: Hector Alvarez <alvarez.hectorm@outlook.com>
Date: Sun, 13 Sep 2026 16:31:59 -0500
Subject: [PATCH 6/7] chore(cline): record housekeeping completion in memory
 bank

---
 memory-bank/activeContext.md | 44 ++++++++++++++++++++----------------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/memory-bank/activeContext.md b/memory-bank/activeContext.md
index 91d35d2..1200444 100644
--- a/memory-bank/activeContext.md
+++ b/memory-bank/activeContext.md
@@ -4,29 +4,35 @@ Updated: 2026-09-13
 
 ## Current focus
 
-**Repo housekeeping** on branch `chore/repo-housekeeping` (off `dev`):
-
-1. ✅ Initialize memory bank (this directory) — commit 1.
-2. README corrections (HK-1): drop `robots.txt` from `src/public/` tree (it's
-   build-time generated), note sitemap/robots generation, add alarm tests to
-   the tests tree, add `tasks/` to the repo-layout table.
-3. CI actions bump (HK-2): checkout@v7, setup-node@v7, setup-buildx@v4,
-   login@v4, build-push@v7, hadolint-action@v3.5.0 (majors verified 2026-09-13).
-4. Husky guard (HK-3): skip lint-staged when no staged file matches its globs
-   (silences "could not find staged files" on workflow/env-only commits).
-5. `tasks/` close-out: sprint.md reflects US-001 merged + deployed;
-   backlog HK items resolved.
+**Repo housekeeping — DONE on branch `chore/repo-housekeeping`**
+(5 commits off `dev`, awaiting PR into `dev` + review):
+
+1. ✅ Memory bank initialized (HK-4).
+2. ✅ README corrections (HK-1): `robots.txt` removed from `src/public/` tree,
+   build-time generation note added, alarm storage test added to tests tree,
+   `tasks/` added to the repo-layout table.
+3. ✅ Actions bump (HK-2): checkout@v7, setup-node@v7, setup-buildx@v4,
+   login@v4, build-push@v7, hadolint-action@v3.5.0. All four Dockerfiles
+   pre-validated locally with hadolint 2.15.1 (repo config: only info-level
+   DL3059 in the webhook image).
+4. ✅ Husky guard (HK-3): hook skips lint-staged unless staged files match
+   `^web/.*\.(ts|js|json|css|md)$`; verified silent on yml- and md-only
+   commits (noise previously confirmed on both).
+5. ✅ `tasks/` close-out: US-001 marked merged+deployed (Release #5,
+   healthz 200); HK-1..4 removed; HK-5 (nginx 1.27 EOL re-pin) added as a
+   backlog candidate.
 
 ## Environment state
 
-- `dev` = `origin/dev` = `223d41f`; local `main` reset to `origin/main`
-  (`c7ecdca`, post-rebase-merge). Working tree clean.
-- US-001 deployed (Release #5 success); homepage may serve up to 2 h of edge
-  cache; `healthz` verified 200.
+- `chore/repo-housekeeping` = dev + 5 commits; `dev` = `origin/dev` = `223d41f`.
+- Local `main` = `origin/main` = `c7ecdca` (post-rebase-merge sync).
+- US-001 deployed; homepage edge cache may lag up to 2 h.
 
-## Next steps after housekeeping
+## Next steps
 
+- Open PR `chore/repo-housekeeping` → `dev`; merge (no production risk —
+  workflow changes ride CI on next dev push).
 - Owner: production audio check (alarm tone) → US-001 fully Done.
 - Pick next epic: US-002 (recurring alarms) vs US-004 (multi-clock).
-- Decide HK-5 (nginx 1.27 re-pin) timing — Dockerfile + digest bump + local
-  `nginx -t`.
+- Schedule HK-5 (nginx 1.27 → current stable, tag + digest together).
+

From 4e1d2015f8a2282031de8362749df120c7abe684 Mon Sep 17 00:00:00 2001
From: Hector Alvarez <alvarez.hectorm@outlook.com>
Date: Sun, 13 Sep 2026 16:32:24 -0500
Subject: [PATCH 7/7] style(docs): format root markdown with prettier

---
 memory-bank/activeContext.md |  1 -
 memory-bank/techContext.md   | 16 ++++++++--------
 tasks/backlog.md             |  5 ++++-
 tasks/sprint.md              | 13 +++++++------
 4 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/memory-bank/activeContext.md b/memory-bank/activeContext.md
index 1200444..33a35e1 100644
--- a/memory-bank/activeContext.md
+++ b/memory-bank/activeContext.md
@@ -35,4 +35,3 @@ Updated: 2026-09-13
 - Owner: production audio check (alarm tone) → US-001 fully Done.
 - Pick next epic: US-002 (recurring alarms) vs US-004 (multi-clock).
 - Schedule HK-5 (nginx 1.27 → current stable, tag + digest together).
-
diff --git a/memory-bank/techContext.md b/memory-bank/techContext.md
index 70cb55b..bc21546 100644
--- a/memory-bank/techContext.md
+++ b/memory-bank/techContext.md
@@ -15,14 +15,14 @@
 
 All npm commands run inside `web/`; make targets from the repo root.
 
-| Purpose | Command |
-| :--- | :--- |
-| Full quality gate (before declaring done) | `make check` (lint + typecheck + test) |
-| Dev stack up/down/health | `make dev-up` / `make dev-down` / `make dev-health` |
-| Fast host-only dev loop | `cd web && npm run dev` |
-| Format check (CI-enforced) | `cd web && npm run format:check` |
-| Coverage | `cd web && npm test -- --coverage` |
-| Production build | `cd web && npm run build` → `web/dist/` |
+| Purpose                                   | Command                                             |
+| :---------------------------------------- | :-------------------------------------------------- |
+| Full quality gate (before declaring done) | `make check` (lint + typecheck + test)              |
+| Dev stack up/down/health                  | `make dev-up` / `make dev-down` / `make dev-health` |
+| Fast host-only dev loop                   | `cd web && npm run dev`                             |
+| Format check (CI-enforced)                | `cd web && npm run format:check`                    |
+| Coverage                                  | `cd web && npm test -- --coverage`                  |
+| Production build                          | `cd web && npm run build` → `web/dist/`             |
 
 CI-relevant changes (compose, Dockerfiles, `nginx.conf`) must be validated
 locally with the same checks CI runs (hadolint via `hadolint/hadolint` image,
diff --git a/tasks/backlog.md b/tasks/backlog.md
index 41ac276..ac13f97 100644
--- a/tasks/backlog.md
+++ b/tasks/backlog.md
@@ -7,12 +7,14 @@ sized/sequenced by the SDM.
 ## Epic: Alarms
 
 ### US-002 — Recurring (daily-repeat) alarms
+
 - Status: Candidate — needs a user story from the Product Owner before work.
 - Source: MVP cut recorded in US-001 ("Out of Scope": daily-repeat alarms).
 - Priority: High — most requested natural follow-up to US-001.
 - Dependencies: none (builds directly on the US-001 alarm core).
 
 ### US-003 — Alarm ergonomics follow-ups
+
 - Status: Candidate — small items culled from the US-001 code review (non-blocking).
 - Contents:
   1. Extract the FLIP panel-open helper duplicated between timer.ui.ts and
@@ -27,6 +29,7 @@ sized/sequenced by the SDM.
 ## Epic: Multi-clock
 
 ### US-004 — Wire up the multi-clock registry
+
 - Status: Candidate — `clock-registry.ts` scaffold exists but is not wired.
 - Source: README ("Multi-clock scaffold — not wired up yet"); recommended as
   the next major epic after the Alarms epic.
@@ -37,6 +40,7 @@ sized/sequenced by the SDM.
 ## Housekeeping (backlog, non-story)
 
 ### HK-5 — Re-pin the nginx base image off the EOL 1.27 branch
+
 - Status: Candidate (found 2026-09-13 during the repo date/staleness audit).
 - Finding: `nginxinc/nginx-unprivileged:1.27-alpine` was last built
   2025-06-23; the 1.27 mainline stopped shipping when 1.29 released, so the
@@ -47,4 +51,3 @@ sized/sequenced by the SDM.
   the image tag in `.github/workflows/ci.yml` (nginx-config-check), and run
   `nginx -t` locally on both configs.
 - Priority: Medium — security updates are accruing on the EOL branch.
-
diff --git a/tasks/sprint.md b/tasks/sprint.md
index 74303b9..01f87b2 100644
--- a/tasks/sprint.md
+++ b/tasks/sprint.md
@@ -5,6 +5,7 @@ Sprint window: active (no fixed calendar sprint; pipeline-driven).
 ## Completed (pending final QA)
 
 ### US-001 — Multiple Alarms (Epic: Alarms)
+
 - Status: **MERGED + DEPLOYED.** PR #13 merged 2026-09-13 21:17Z (linear
   history, 9 commits).
 - Release run #5 succeeded 21:18Z; webhook deploy fired; `/healthz` verified
@@ -17,6 +18,7 @@ Sprint window: active (no fixed calendar sprint; pipeline-driven).
 ## In flight
 
 ### Housekeeping branch `chore/repo-housekeeping` (→ PR into `dev`)
+
 - HK-1 README corrections, HK-2 Actions bump to Node-24 majors
   (checkout@v7, setup-node@v7, buildx@v4, login@v4, build-push@v7,
   hadolint-action@v3.5.0), HK-3 husky lint-staged guard, HK-4 memory bank
@@ -40,9 +42,8 @@ next epic: US-002 (recurring alarms) vs US-004 (multi-clock).
 
 ## Risks
 
-| Risk | Likelihood | Impact | Mitigation |
-|---|---|---|---|
-| Production alarm audio unverified | Medium | Medium (US-001 DoD gap) | Owner manual check; tracked above |
-| nginx 1.27 base gets no security updates (EOL mainline) | High | Medium | HK-5: re-pin to current stable |
-| Edge cache hides new deploys for up to 2 h | By design | Low | Judge freshness via `/healthz` |
-
+| Risk                                                    | Likelihood | Impact                  | Mitigation                        |
+| ------------------------------------------------------- | ---------- | ----------------------- | --------------------------------- |
+| Production alarm audio unverified                       | Medium     | Medium (US-001 DoD gap) | Owner manual check; tracked above |
+| nginx 1.27 base gets no security updates (EOL mainline) | High       | Medium                  | HK-5: re-pin to current stable    |
+| Edge cache hides new deploys for up to 2 h              | By design  | Low                     | Judge freshness via `/healthz`    |